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7 THE IMPACT OF RELIABILITY REQUIREMENTS ON ORGANIZATION IN THE 
MANUFACTURE OF AIRBORNE ELECTRONIC EQUIPMENT 


John J. Crowley 
General Dynamics Corporation 
Washington, D. C. 


The thesis of this paper, taken from data collect- 
ed over the last four years (including the relia- 
bility experience data on Stromberg-Carlson's 
TACAN production run), is that reliability re- 
quirements have an impact on organization; that 
this impact is in the direction of adding func- 
tions, redefining functions, and changing or mod- 
ifying structures; and that the changes in organ- 
ization depend upon the past history of the 
company, its product line, its size, and the time 
in the development cycle that the reliability re- 
quirements are evaluated by management. 


To define the terms of the title, "reliabili- 
ty requirements" is to be understood as meaning 
requirements contractually imposed by the customer 
with the purpose of insuring that. the equipment or 
procured end item will have a designated numerical 
probability of failure-free or undegraded opera- 
tion during a specified time interval under pre- 
scribed conditions of performance, environment, 
and operator skill. Reliability is a probability 


‘associated with a time function, whose limiting 


values are design parameters. "Airborne electron- 
ic equipment" is considered to be equipment car- 
ried either by a manned aircraft or by a guided 
missile. I have used the term "organization" to 
delineate the relationships among the people who 


carry out the various tasks incident to producing 
-end items for a customer. 


It indicates their du- 
ties and responsibilities as specified by job de- 


‘scriptions and also the flow of authority in the 


decision-making process. Organization exists to 
enable a company to accomplish the basic mission 


in an efficient manner competitively with other 


‘companies similarly engaged. 


’ I shall now demonstrate my thesis with case 
histories drawn chiefly from the various divisions 
of General Dynamics. First I'l] take Stromberg- 
Carlson, but only briefly, because it's in the 
literature for those who are interested. Strom- 
berg has basically a background as a supplier of 
electronic equipment. It is an old, well- 
established company with about 9,000 employees. 
They happened to be manufacturing TACAN at about 
the time that the Office of Secretary of Defense 


‘and Congress were investigating certain airborne 


electronic equipments which had been rushed into 
production as an aftermath of the Korean War. The 
disclosures relative to the reliability status of 
these equipments caused OSD to look critically at 
other.equipments -- and there was TACAN! After an 
AGREE Committee made an investigation, extensive 
pressure was put on the Avionic Division, Buser, 
and through that agency on each of the three 
contractors. | = ; 


Stromberg didnot have a reliability group 
per se at that time... Production was monitored by 


Quality Control, and when the bomb burst, Quality 


Sas 


' Warse 


Force. 


Control was expanded to cover a number of areas 
normally associated with reliability. Extensive 
testing was initiated, which meant procurement of 
expensive environmental test facilities. These 
extra facilities had to be placed under someone's 
control. In view of the fact that Quality Control 
was already monitoring the production and would be 
expected to perform the extended inspection, test- 
ing, selection of parts, and so forth, the envi- 
ronmental laboratory came under that group. 


A similar decision was made with reference 
to the need for a failure-reporting and data- 
analyzing group, as well as the addition of nun- 
erous ad hoc committees set up to coordinate 
findings with the other contractors and to 
trouble-shoot specific problems. The result of 
being hit in the middle of a program, which was 
in production at the time, by the enhanced relia- 
bility requirements necessitated pursuing a path 
which would accomplish the mission as expedi- 
tiously and with as little disruption as possible. 
Since this solution solved the problem, as of to- 
day, the reliability efforts at Stromberg-Carlson 
remain under Quality Control, although a USAF 
evaluation suggests the need for top-level co- 
ordination of the reliability effort. 


It must be remembered that reliability has 
always been a desired attribute of any consumer 
item. Cost determined how much you got of it. 
Reliability has always been one of the design 
parameters, but it was slighted badly by many de- 
signers in favor of performance. Yet prewar 
electronic equipment was quite simple and there 
was not too much of it, so no great problem was 
apparent. Things changed following the techno- 
logical revolution associated with the recent 
Equipments have become exceedingly complex, 
and in the case of airborne equipments, size and 
weight considerations are of paramount importance. 
When you add the environment of a missile to these 
considerations, you begin to grasp the magnitude 
of the revolution. Reliability is still a par- 
ameter to be optimized, but the requirements for 
it are much higher and the difficulty of achiev- 
ing it is vastly greater. The job has changed, 
and so has the organization to achieve it. 


Convair-Fort Worth is the second largest Con- 
vair Division, employing more than 20,000 person- 
nel. Its background is aircraft manufacture, and 
4t produced large numbers of B-36's for the Air 
As you all know, the B-36 is a very large 
aircraft with very complex electronic fire control, 
communications, and bombing and navigational 
equipment. To keep one operating was a serious 
task. So when the B-58 program began, Fort Worth 
was aware of some of the problems it would face. 
Here was to be an entirely new bomber with super- 
sonic dash capability beyond any operational air-. 
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craft, powered by a new engine, involving new con- 
struction materials and methods, and carrying the 
most advanced bomber=navigation system so far con- 
ceived. Admittedly, Fort Worth would not make the 
bomber-navigation, or for that matter, any of the 
complex electronic equipment which had to be 
packed in the fuselage like sardines in a can. 
(Unlike the sardines, however, this electronic 
equipment generated heat to be dissipated and was 
capable of absorbing heat from the aircraft skin 
during supersonic flight.) But its systems man- 
agers had to specify and evaluate what they were 
procuring. Now there was no production in this 
case, although hopes for the future were high. 


The concepts of reliability were gradually 
evolving throughout the Department of Defense dur- 
ing the early development stage of the B-58. 

These concepts and the resulting requirements im- 
pacted over a period of time in such a manner as 
to allow reliability functions to be absorbed in 
or assigned to existing structural elements. How- 
ever, because so many parts of the organization 
had responsibilities for reliability, Chief Engin- 
eer Frank Davis evolved a novel and interesting 
structure which appears to be working satisfactor- 
ily as of now. This new engineering perspective 
may best be described in Davis’ own words. 


"The product of an engineering department 
is ideas. Expressed verbally, graphically, and 
in many other ways, these ideas are transmitted 
to other elements of the organization who trans- 
late them into usable hardware. The final form 
and character of the hardware is established by 
many individual design decisions. The consider- 
ations entering into each decision come from 
three directions: 


™, The objectives of the particular project 
in question; i.e., project management. 


"2, The desire to achieve certain product 
qualities; e.g., safety, performance, 
reliability. 


"3, The specialized engineering skills in- 
volved in design decisions; e.g., aero- 
dynamics, thermodynamics, structural de- 
sign, etc. — 


"The areas considered as product qualities — 


are indicated as staff functions. Each of these 
qualities has a center of gravity in one of the 
line organization groups or sections. The as=- — 
signment of the staff responsibility (to the 
Chief Engineer) has in each case been made as a 
dual assignment to the particular line supervi- 
sor who has within his line organization the 
necessary skill, know-how and manpower to accom- 
plish planning, programming, advice, and follow- 
up required in the staff function." te 


Thus, Mr. Reade appears on the organization 


chart as a staff function for the Product Quality- — 


Reliability. He also appears in the line under 
the Chief Design Engineer as Head of Systems In- 
stallation, Systems Reliability, and Malfunction 
Analysis. 


It is quite probable that some shift will oc- 
cur in the organization as the ‘B-58 goes into pro- 
duction, but I do not think it will be major. It 
is built on what I believe to be a basically sound 
concept. Apropos of this, I could not have stud- 
jed the problem as I did for the last years at DOD 
without having evolved a philosophy of management 
as it relates to reliability programs. I would 
like to quote from a presentation I made to the 
management group at Convair-Fort Worth and Chance 
Vought in November, 1956. I haven't changed my 
concept since that time, not because I'm too stub- 
born or pigheaded to change, but because all late- 
ly evaluated evidence tends to support the theory. 


"Now, since reliability has been shown to 
apply throughout the industrial cycle, industry 
has had to face a novel organizational problem. 
Industry reaction was, in the first impact, 
characterized by two widely divergent direc- 
tions. One direction was to emphasize, by edu- 
cational processes, the over-all responsibility 
for reliability. Big signs carried the slogan 
Reliability is Everyone's Business! and since 
this was all that was done in many cases, the | 
corollary followed that ‘Everyone's Business is 
No One's Business.’ A second direction was the 
establishment of a highly integrated reliability 
group with selected personnel from Engineering, 
Manufacturing, Marketing, etc. The first tech- 
nique produced little, if any, real effect al- 
though certainly an educational effort is an es- 
sential part of any good reliability program. 
The second tended to divorce ‘responsibility for 
reliability from the very individuals who, in 
the last analysis, were responsible. A realiza- 
tion has come about gradually that since the 
responsibilities for reliability are individual ° 
and throughout the entire industrial cycle. they 
willbe most effectively excercised when they 

- are buttressed and serviced where ‘they exist by 
a modern management function whose only area of 
specialization and operation is reliability. 


’ “Once such an organizational philosophy has 
been decided upon and' the composition and duties 
of the group determined, the next management . 
task is to determine where to, locate the func- 
tion -- where should it be and to whom should it 
report? It appears that a fundamental axiom ap- 
plies here; i.e., to be effective it should re- — 
port high enough so as to be-assured it can im- 
plement its responsibilities for reliability. 
Once that has been said, it is up to.the indivi- 
dual company to determine the specific location 
and report structure. Some companies havea 
vice-president in charge of the entire relia- 
bility program;: others yse.a committee struc- 
ture in am executive position just above the 
Engineering, Marketing, Manufacturing, etc., . 
Divisions; and many managers retain the respon- 
sibility themselves. . Where -the reliability pro- 
gram is-located is an éxpedient basically de- 
pendent upon the corporate structure -- its. 
composition and where it reports are the’.all 
important factors." — es aol I aed 


I shall go over the otganigational activities 
of the San Diego Division very briefly.’ This is 


on 


the largest and oldest of the Convair divisions, 
employing more than 25,000 personnel, Its product 
line is aircraft, although it has served asa ~ 
spawning ground for ideas which turned.out TERRIER, 
ATLAS, and other projects now carried as separate 
divisions. A reliability program has been set up 
by Division Regulation with the purpose of estab- 
lishing the basic policies, procedures, and res- 
ponsibilities required to insure the attainment of 
the highest degree of reliability in the develop- 


ment and manufacture of Convair-San Diego products, 


A Reliability Policy Conmittee has been instituted 
with the following members: Assistant Chief Engi- 
neer (Chairman), Chief of Reliability, Human Fac- 
tors and Acoustics, Engineering; Manager of Con- 
tracts, Factory Managers, Manager of Manufacturing 
Development and Process Specifications, Manager of 
Material, Manager of Quality Control, Chief Tool 
Engineers. 


It should be noted that the Chairman is not 
the reliability coordinator.*, A second noteworthy 
item relates to the size of this organization, a 
factor which will make it difficult to assemble 
and to arrive at decisions. However, its first 
function is to set up policy and probably subsid- 
lary organizations and broad representation is re- 
quired. I have not observed its operations. But 
since the establishing decument was made effective 
as of September 30, 1957, I believe it to be rela- 
tively new, and later experience may modify the 
structure. San Diego is responsible for the de- 
velopment and production of the USAF F-102 - F-106 
interceptors. These aircraft have very complex 
fire control systems. Unlike the Fort Worth B-58 
program, however, where that company is Weapons 
Systems Manager for the entire aircraft, the res- 
ponsibility for the fire control systems of the 
USAF F-102 - F-106 aircraft belongs to Hughes, 
where a very substantial reliability effort is 
sponsored. 


_ Convair-Astronautics, employing about 8,000 
personnel, is the newest Convair division. It is 
set up expressly for the development and subse- 
quent manufacture of the ATLAS ICBM. Since it was 
missile-oriented in its inception, this statement 
of Manager J. Dempsey is not surprising: 


"Reliability is not only the function of a 
special reliability group which we have set up, 
but must be an inherent part of our basic design 
and manufacturing philosophy. To this end, we 
have in the division a Reliability Committee, 
chairmaned by the Division Manager, and includ- 
ing our senior technical and manufacturing 
people. The emphasis on this committee's acti- 
vities is placed on integrating reliability con- 
cepts to our line management structure." 


Mr. Eppenstein, Supervisor of the Reliability 
Group, Engineering Department, states that the ef- 
fects of the reliability requirement have been 
much less pronounced than was expected early in 
the development of reliability programs. The 
changes which have taken place are not drastic. 

In most instances, the only outward evidence of 
the initiation of the reliability activities has 
been the creation of a reliability organization as 


a new element within the over-all company organi- 
zational structure. The Reliability,Group does. . 
"bird dogging," data handling and analysis, and 
promotion of a return to the valuable teamwork as- 
pect of the old guild. There have, of course,, 
been increases in assignments to, existing struc- 
tures but, in the main, the impact. ‘at’ Astronautics 
is the total acceptance by all division members of: 
the need for reliability and a realization of the 
disastrous consequences of, unreliability. The. 
competition, nationally and: internationally, for a” 
highly reliable missile is extremely keen. 


The Pomona Division of Convair employs about - 
5,000 personnel, Since its inception it has been 
missile-oriented, although it did originate as 
part of the San Diego Division. This has-had an- 
interesting history in the development and produc- 
tion of the TERRIER missile. Now, TERRIER was 
originally designed as a test vehicle for the | 
TALOS. The decision to produce TERRIER found Con- 
vair in the position of attempting to make the 
best of a bad situation, that is, reliable mass 
production of a had-made device put together with 
the basic idea of testing developmental concepts. 


The Convair organization at that time was es- 
tablished primarily along typical aircraft lines. 
Little formal reliability effort existed then he-. 
yond a program for performing environmental tests 
on each of the TERRIZR components to see if they 
could qualify under established specifications. 
From the outset this test program was in serious: 
trouble due to the inability of the components to. 
perform under the conditions which had been estab- 
lished. Inspection was organizationally separated - 
from the engineering and manufacturing operations’ . 
performing primarily the routine functions associ- 
ated with insuring reasonable standards of work- 
manship. During this formative period, one K. T.- 
Keller stepped in and added considerable pressuré 
to get results. And in addition, the whole acti- 
vity was transferred from San Diego to Pomona! 


The establishment of a formal reliability 
group within the Engineering Department: was among 
the first of several basic organizational changes. 
A joint engineering-inspection program for report- 
ing component failures followed. This effort was 
in itself not particularly effective until a fail- 
ure diagnosis group was added, made up of high- 
caliber design engifeers working as, a team with 
representatives of the Inspection and Manufactur- 
ing Departments. This diagnosis team was given 
the broad authority to stop factory operations 
until a thorough diagnosis of the underlying caus- 
es of failure were determined. The functions of 
Flight Test and Flight Analysis were separated, 
which had the effect of concentrating more effort 
on the analysis and correction of flight failures. 
Procedures were established for the reporting and 
feedback of all findings to groups responsible for 
taking corrective action. 


As soon as the production and flight problems - 
smoothed out, the formal reliability group was 
transferred to a newly forned Quality Control De- 
partment, also responsible for the inspection 
function. This quality control group, headed by 


a very competent design engineer, reports directly 
tq the General Manager. The failure diagnosis ef- 
fort, under a joint engineering-inspection factory 
team, has been continued. The Flight Analysis 
Group within the Engineering Department maintains 
a rapid system for feedback.of flight-failure in- 

’ formation to design groups. There are, in addi- 
tion, a number of special purpose committees who 
evaluate. product design, manufacturability, and 
the like... The Pomona organization is character- 
ized by the lack of any special reliability co- 
ordinator whose job it is to see that all possible 
techniques are being used and to monitor the out- 
puts. However, the size of the organization per- 
mits all echelons of management to be continually 
aware on a day-to-day basis of any performance or 
reliability problems, and the Genera] Manager does 
not take the responsibility lightly. In effect, 
the General Manager and the several Assistant Gen- 
eral Managers become the final Reliability Policy 
Committee and Review Board. 


; ' An interesting comment on the factors which 

have generated: the present high reliability of the 
TERRIER missile comes from one of the responsible 
design ‘engineers. He states that missile develop- 
ment forces a contractor to place heavy emphasis © 
on test equipment, and that frequently’ as much 
time is spent on the development of test equipment 
as on the missile itself, with this emphasis hav- 
ing its impact ‘on the organization. I quote him 
as saying, "We now recognize that our success in 
design of test equipment is a major factor in the 
ultimate reliability of our missiles." 


One last description. Canadair has recently 
been making plans to manufacture an air-to-air 
‘missile. Canadair is one of the two largest air- 
craft builders in Canada, employing about 9,000 
people and heavily aircraft-oriented. This mis- 
sile has been developed by another company, but 
has not been fully tested. Canadair had limited 
previous experience with the VELVET GLOVE air-to- 
air missile, which was cancelled some time ago. 
Contracts were slow in being awarded. (I believe 
we sometimes have that problem here in the United 
States too.) Therefore, Canadair has had ample 
time to plan to produce. Their planning clearly 
shows the effect. of reliability requirements which 
are foreseen and evaluated early in the cycle. It 
also clearly shows the effects of previous history 
and product line. ~ 


The two main divisions of Canadair are Engin- 
eering and Production. Historically, the emphasis 
has been on production so most of the tools came 
under Production cognizance. Quality control, in- 
stead of being a division equal to Engineering and 
Production, falls under the latter. Thus Produc- 
tion, in effect, monitors itself. Engineering and 
Manufacturing have been divided into two branches, 
one for missiles and the other for aircraft. This 
is the first organizational shift.. Experience of 
other missile manufacturers has been evaluated by 
Canadair, and they have concluded that the co~ 
ordination of the various aspects of reliability 
requires a special organization of its own. 

First, this special organization mst evolve a 
company-wide policy of reliability; secondly, it 


' out program. 


must provide regular channels by which reliability 
data could be collected, analyzed, and formulated 
into recommendations; and thirdly, it must provide 
means by which these recommeridations can be 
brought to the attention of the departments con- 
cerned for corrective action. 


The special organization involves the estab- 
lishment of the position of Reliability Coordina- 
tor who, though he reports to the Chief Engineer 
(Special Weapons), would have responsibilities 
which would cut across departmental lines. A Re- 
liability Policy Committee is proposed, with a 
Director of Quality Control, Chief Engineer (Spe- 
cial Weapons), and a Director of Manufacturing, as 
members with responsibility for reliability policy 
or revision of policy. Directly responsibl¢g_to 
the Reliability Coordinator would be a Reliability 
Operations Committee composed of representatives 
from Quality Control, Engineering, Manufacturing, 
and Sales and Service. This group would take ac- 
tion on problems whose manifestation depends upon 
collection and data analysis. The more apparent 
problems would be handled by a Reliability Review 
Board, a special board set up to handle reliabili- 
ty complaints as they occur. Specific members 
from each department would be assembled to handle 
the particular complaint as a board and to take 
appropriate action. The Reliability Coordinator 
would act as Chairman of this Reliability Review 
Board. 


All this represents a very carefully thought- 
It has some obvious weaknesses, but 
they are predetermined by previous history. Pro- 
grams can be carried on with inefficient organiza- 
tional structures; this is happening daily. But 
good organization expedites the end product; it 
does not hamper its achievement. 


From these and many other related observa- 
tions, I hope I have proved my thesis: that reli- 
ability requirements do have an impact on organi- 
zation; that the impact is in the direction of 
adding functions, redefining functions, and chang- 
ing or modifying structures; and that the changes 
in organization depend upon the past history of 
the company, its product line, its size, and the 
time in the development cycle the reliability re- 
quirements are evaluated by management. 


I would like to close my remarks with a quo- 
tation and a comment. The quotation is from the 
data I received from Astronautics: 


"Of interest is the fact that recognition 
of the reliability requirements of airborne 
electronic equipments has indirectly brought 
about a significant forward step in many other 
areas of industry. Specifically, it is being 
discovered that as the reliability programs, 
generated and given impetus by the reliability 
requirements of airborne electronic equipments, 
spread into fields such as hydraulics, pneuma- 
tics, structures, and electric power, startling 
new gains are being realized. It appears more 
and more likely, as experience with reliability 
programs is accumulated by an ever increasing 
number of organizations, that the broad field 


of electronics -- and in particular the field of 
airborne electronics -- is no more fertile an 
area for application of reliability concepts 
than a host of others not previously considered 
eeeand extending as far afield as commercial or- 


ganizations who provide only services as their 
product." 


In my estimation, we have only begun to re- 
alize the full potentialities of achieving high 


reliability. Too many executives give only lip 
service to the concept. I have noted two tenden- 
cies lately. One of these relates to the quackery 


and empire-building inclinations of humans to cap- 
italize on a popular concept such as reliability. 
This is not applicable to the divisions of General 
Dynamics, where I feel our pursuit of reliability 
is certainly not too extensive, but it does apply 
to some elements in the missile industry. The 
second tendency is the reaction to this fraud 
which inevitably follows both in the company con- 
cerned and in those companies who watch the prob- 
lem from the outside. Such quackery and empire 
building are intolerable, but when we "throw the 
rascals out" let's be careful not to throw out the 
“potatoes with the potato water." 


CURRENT MILITARY RELIABILITY SPECIFICATIONS 


E. F. Dertinger and D. W. Pertschuk 
Arma Division 
American Bosch Arma Corporation — 
Garden City, New York 


In general, the work engineers perform in writing, 
reading, interpreting, and discussing specifica- 
tions is not counted among the more exciting part 
of their activities. In the field of reliability 
engineering today, however, the spotlight is very 
much on the subject of specifications. We are 
clearly on the threshold of a major breakthrough 
in this area. We have been talking about and ex- 
perimenting with reliability specifications for a 
long time now; we have seen in the past an occa- 
sional application of such specifications, but in 
the months ahead we must be prepared for the inev- 
itable fact that reliability specifications will 
be applied to every major contract assigned by the 
Department of Defense. This is an appropriate 
time, therefore, to comment on some of the feel- 
ings and attitudes of military contractors towards 
the whole subject of reliability specifications. 


One important point should be clarified at 
the outset. Contractors of military equipment are 
not opposed to the application of reliability 
specifications to their products, nor do they fear 
that these specifications will make it more diffi- 
cult for them to produce satisfactory equipment. 
On the contrary, the present general absence of 
concrete reliability specifications is presenting 
them with a confusion of insurmountable problems 
in building and testing equipment, and getting ac- 
ceptance of the end item. Let us consider this 
situation for a moment, 


For several years now, we have heard repeated 
requests from the Military for increased equipment 
reliability. It is the sincere desire of most 
contractors to supply equipment with both func- 
tional adequacy and the necessary reliability. 
Reliability, however, is not a characteristic 
which can be applied to the equipment like an ad- 
ditional coat of paint. It is a complex intangi- 
ble requiring for its attainment a difficult and 
basic effort on the part of the contractor. In 
reaching for this objective, he has every right to 
expect that the Department of Defense, which so 
badly needs reliable equipment, will give him all 
the help possible. The most urgently needed help 
currently required is a workable and meaningful 
specification or set of specifications. Let us 
look at some of the problems facing the contractor 
who attempts to produce high reliability equipment 
without a set of specific requirements from his 
customer. 


In the first place, despite the undeniably 
great economic value of reliability programs, 
these programs are initially expensive. If the 
contractor allows for the additional expenditures 
in his proposal, he runs a risk of becoming non- 
competitive. If he doesn't allow for them in his 
proposal, he cannot justify the additional man- 
power required, the production of additional 


equipment for testing, nor any of the other ex- 
penses of a reliability program. The end product ~ 
is finally delivered at a price of $100,000 in- 
stead of $115,000, and a million dollars is spent 
over the next five years patching it up in the 
field. A good reliability specification, on the 
other hand, would have the effect of demanding the 
proposal of an adequate reliability program, would 
lead to provision of proper funds, and would in- 
sist upon the accomplishment of the program and 
delivery of reliable hardware. 


Another problem is that it is not always easy 
to convince top levels of management that it is 
necessary to set up an organization capable of di- 
recting the reliability effort on the various mil- 
itary contracts being handled by that company. A 
reliability organization does not spring up over- 
night any more than an engineering or a quality 
control organization can be created instantly. 
Once the Department of Defense defines a clear re- 
liability policy, implemented with specifications, 
industry will know what will be expected and can 
take the necessary organizational measures. 


Perhaps the most important problem of all is 
that contractors cannot live with meaningless con- 
tractual obligations to produce "high reliability 
equipment" or "equipment sufficiently reliable for 
its intended use." They must be relieved of play- 
ing guessing games as to what reliability means 
and what constitutes reliable equipment. Again, 
only meaningful and precise specifications can 
clear the air. 


There is little doubt, then, that reliability 
specifications are needed and that their lack 
causes serious difficulties. The various agencies 
of the Department of Defense have, of course, been 
aware of these problems. But the mere existence 
of a problem does not automatically produce a so- 
lution. Considerable work had to be accomplished 
and, in effect, the theory and practice of relia- 
bility engineering had to be advanced before tech- 
nically valid specifications could be written. 
Much of this work was undertaken jointly by the 
government and by industry, culminating in such 
recent reports as those of the AGREE Committee and 
the Ad Hoc Committee for Guided Missile Reliabili- 
ty. Both committees function under the direction 
of the Office of the Assistant Secretary of De- 
fense; the former has been concerned with the re- 
liability of all nonmissile electronics, while 
the latter has been working solely on missile re- 
liability. 


The AGREE Committee recently released a re- 
port resulting from a two-year study by nine Task 
Groups. The assignments of these nine Task Groups 
is listed below. 


AGREE Report of June, 1957 


(OASD/Eng. ) 
Task ; 
_ Group 
1 Numerical reliability requirements 
2 Development model tests 
3. Pilot production and production tests 
4 Specification of design procedures 
5 Specification of component parts reliability 
6 Evaluation of procurement practices 
7 Packing, shipment, transportation practices 
8 Study of effects of storage 
9 Study of services maintenance procedures 


This report is being utilized by the services in 
the creation of reliability specifications for 
future electronic equipment, and as such, is high- 
ly recommended for your study. The work of the 
Missile Reliability Committee has progressed to 
the stage of issuing a first draft for industry 
comment. In many areas, the findings and recom- 
mendations of these two comittees are very 
similar. 


Now that we have covered the general area of 
the reliability specification problem, let's take 
a look at some of the more specific actions which 
have been taken by the Military. In July, 1956, 


-the Department of Defense issued a directive on 


the subject of the approval of new electronic 
equipment for service use. This directive, DOD 
3222.1, shows a full understanding of the need to 
specify reliability requirements. Perhaps we may 
quote one or two phrases from this directive: It 
is required to "determine from engineering tests 
the ability of the equipment or system to meet the 
technical performance requirements." Here we have 
a clear indication that technical performance re- 
quirements, among which we must certainly count 
reliability, must be evaluated through a testing 
procedure. 


We quote again: It is required to "determine 
by suitable tests the ability of the equipment or 
system to meet the operation performance require- 
ments in a service or simulated service operation- 
al and maintenance environment." Again, a clear 
indication of the need for testing. But later on, 
the directive is much more specific -- pilot pro- 
duction is required "to provide sufficient numbers 
of the new equipment or systems to permit a real- 
istic evaluation of performance and reliability," 
and "to permit the determination and correction of 
design deficiencies affecting producibility or re- 
liability before large quantity production for 
service use is undertaken." Even today, it might 


‘be mentioned in passing, many electronic systems 


* 


ae 


would like to see contained in a reliability spec- 


are being designed and produced by the most con- 
scientious of contractors, many of whom cannot le- 
gally utilize any of their production for mean- 
ingful reliability tests. The Department of De- 
fense directive ends with instructions to each 
military department to implement the policies and 
procedures which have been outlined. 


We shall now discuss what the contractor 


ification. We speak, of course, only as represen- 
tatives of American Bosch Arma, but the ideas we 
are expressing here are endorsed by a large cross 
section of industry with whom we discussed these 
matters. 


There are two types, or species, of reliabil- 
ity specifications which are needed -=- the general 
and the specific, The first type sets forth a re- 
liability philosophy applicable to a reasonably 
large class of equipment, such as missile elec- 
tronics or shipboard radar, The second type sets 
forth specific reliability requirements for spe- 
cific equipments or systems, such as the inertial 
guidance system for the Titan missile, or the tail 
defense system for the B-52 bomber. 


MIL-R-25717B, written by and for the Air 
Force, is an excellent example of the general re- 
liability specification. It deals with such mat- 
ters as the degree of responsibility given to the 
contractor, the organization necessary for the de- 
sign and production of high reliability Squipment, 
the relationship between quality control and reli- 
ability, the necessity for failure reporting and 
analysis, the control of subcontractors and ven- 
dors, and other items of a similar nature. Also, 
while making six references to the "detailed spec- 
ification for the particular equipment" for quan- 
titative reliability requirements and the method 
of proving conformance thereto, MIL-R-25717B also 
contains suggested test methods and sample quanti- 
tative requirement statements which may be util- . 
ized. In:addition, the spec makes reference to 
the AGREE report previously mentioned for general 
guidance. 


MIL-R-25717B covers a large but manageable 
group of equipment, specified as electronic equip- 
ment. A specification of this nature aids the 
contractor immeasurably in forecasting what the 
Air Force will expect of him in fulfilling a.con- 
tract for electronic equipment. He sees the nec- 
essity for setting up a reliability organization; 
he knows the degree of reliability responsibility 
he must assume; and he can deduce the effect of 
the reliability effort on all parts of his organ- 
ization. He is not told very much, however, about 
the specific reliability requirements applicable 
to any particular piece of equipment to be pro- 
duced now or in the future. For this information, 
he is referred to the detailed equipment specifi- 
cation, an approach which we feel to have merit. 


Buder Specification MIL-R-19610 is an example 
of the detailed specification. It is being ap- 
plied only to airborne TACAN equipment. This 
specification has caused much discussion, both pro 
and con. Whatever may be ultimately right or 
wrong with this document, there is no question 
that it gives most of the information necessary to 
fulfill contractual reliability obligations. The 
contractor is given the numerical reliability re- 
quirements in a form which is meaningful in terms 
of the equipment covered; he is told what tests he 
must run, and (although indirectly) the quantities 
he must test. Also, we are told that the equip- 
ment produced to this spec was of much higher re- 


liability than that which was produced without a 
reliability spec. 


We would not wish to hold up either of the 
documents we have discussed as perfect examples of 
reliability specifications. It may well be sever- 
al years before we can approach a state of perfec- 
tion in this area. It is clear, however, that 
both of them represent enormous advances over any- 
thing seen before and provide at least a basis 
upon which work can be continued. 


We will conclude by listing below the re- 
quirements which we believe should be contained in 
and form the central core of the set of specifica- 
tions, both general and specific, leading to the 
design and production of high reliability equip- 
ment. These specification needs are: 


1. Reliability organization 

2. Reliability plan 

3. Numerical reliability requirement 
4. Component parts 

5. Subcontractor reliability control 
6. Reliability check points 

7. Failure reporting 

8. Reliability improvement program 


The specifications should outline the form or , 


alternate forms of reliability organization which 
a contractor should have available to fulfill his 
obligations in this area. This is certainly as 
necessary as the contracting agency's requirements 
for a proper quality control organization, a prop- 
er purchasing organization, and evidence of an en- 
gineering organization capable of performing the 
required tasks. 


The specifications should call for a contrac- 
tor to submit a reliability plan with the initial 
proposal, and to follow this plan with implementa- 
tion details early in the development phase of the 
contract. It is our opinion that a specification 
should not describe minute details of reliability 
work, but should rather require that the contrac- 
tor submit sufficient information for customer 
evaluation and approval. 


A desired numerical reliability must be stat- 
ed in terms which are meaningful for the specific 
equipment designed. In other words, careful con- 
sideration should be given to expressing the de- 
sired reliability in terms of mean-time-to-failure, 
probability of success, or permitted failures in a 
given time period. Moreover, this requirement 
must be clearly defined. If it is stated that no 
failures must occur in a given test, both the 
meaning of "test" and the meaning of "failure" 
must be given clearly. 


It must be recognized that system reliabil- 
ity is dependent on component part reliability and 
must clearly state what is expected in the area of 
component parts. While the burden of reliability 
must be placed on the prime contractor, the parts 
vendors must be brought into the picture, and the 
reliability specification mst allow for such in- 
clusion. We will never have reliable equipment 
if the thousands of component part vendors with 
whom we do business are not made to appreciate 
fully the problems we face. At Arma we have found 
vendors desirous of bettering their products and 
of meeting our specifications. However, in order 
to accomplish this goal, we had to make them part 
of the team, with a thorough knowledge of our 
goals and parts problems. Test data is being sup- 
plied to vendors and parts are being improved as 


.a result. 


The specifications must place upon the prime 
contractor the necessity for subcontractor relia- 
bility control, but he must also receive military 
support and contractual coverage for such control. 
They must allow for the evaluation of reliability 
and for certain check points in the program for 
the assessment of reliability. When reliability , 
tests are called for, the contract must clearly 
assign systems, assemblies, and/or parts for that 


purpose. 


A suitable failure reporting program, speci- 
fying its use for over-all reliability control, 
should be described. Failure reporting should 
continue well into service use of the equipment, 
and proper allowances must be made for this long- 
term effort. When we say failure reporting, we 
include the associated tasks of operating time re- 
cording and suitable equipment logs. 


Finally, the specifications must allow for 
the fact that even with the best of techniques and 
the best of intentions, the equipment can never be 
designed for its ultimate reliability potential. 
As experience is gained in the use of the equip- 
ment by the customer, a need for improved relia- 
bility in certain areas usually becomes evident. 
Consequently, allowances must be made for a reli- 
ability improvement program. 


We have given our comments on the present 
status of reliability specifications and what we 
believe should be the aim and function of these 
specifications. We believe that our opinions are 
shared by the majority of military contractors. 
In any event, there can be little question that 
large-scale application of reliability specifica- 
tions is coming soon. With them, and as a conse- 
quence of them, will also come a step increase in 
the reliability of the equipment we produce. 


RELIABLLITY TECHNIQUES FOR ELECTRONIC CIRCUIT DESIGN 


L. Hellerman and M. P. Racite 
Product Development Laboratory 
International Business Machines Corporation 
Poughkeepsie, New York 


A new approach to the problem of designing relia- 
bility into an electronic circuit is the method of 
synthetic sampling. This method is superior to 

. the commonly used "worst-case" design philosophy, 
which is characterized by the requirement that the 
circuit operate reliably when the components are 
at specified adverse limits.~ We shall point up 
this superiority by considering several shortcom- 
ings of .the worst-case philosophy, as follows: 


1. It makes no distinction between the prob- 
ability of mean and extreme outputs. In 
view of the nature of the output distribu- 
tion, this is often unrealistic, unduly 
pessimistic, and costly. 


2. If a circuit can fail in more than one way 
(for example, from too high an output and 
too low an output) no distinction is made 
between the probabilities of failure from 
the different causes. This unbalance in 
reliabilities, as an example will show, may 
actually make it desirable to design fail- 
ures from one cause into a circuit purpose- 
ly, in order to increase the over-all re- 
liability. 


-3. It provides no measure of reliability. The 
specification of limit component values for 
‘the worst case is somewhat arbitrary, and 
the designer never knows how much reliabil- 
ity he has bought by using one or another 
set of extreme component values. 


Synthetic sampling does not have these weak- 
nesses. It automatically weighs each output with 
-its probability, and it gives the reliability of 
the circuit based on the actual component distri~ 
butions. The method is illustrated in this report 
by application to a typical transistor switching 
circuit. 


_Improbability of Extreme Cases 


Design engineers have questioned the worst- 
case criterion on the ground that the occurrence 
of the worst case may be quite improbable, and the 
requirement that the circuit operate under these 
conditions may be too costly for the reliability 
that it buys. Statisticians may recognize the 
central limit theorem in this phenomenon.2 Our 
first object is to formulate a measure of it -- 
gome rule of thumb to back up the engineer's 
intuition. 


Suppose we have a circuit whose performance 


parameter y is a function of several circuit 
parameters, : 


yan f(x, od >’ Xn) 


We assume the design engineer knows the distribu- 
tion of each component. This information may be 
in terms of the distribution of the deviation of 
the component from its nominal value. 


The deviation of the performance parameter is 
given approximately by the total differential 
formula, 


af of 
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Using the fact that the distribution p,; of 


= Of 
Lal Se SS: (2) 
is related to the distribution f; of dx; by 
Ll fy / OH 
pi(éys) = >> (= ) (3) 
on = \g%4 


the problem of estimating the likelihood of some 
deviation becomes the problem of estimating the 
sum of several random variables, 


dy = dy) + ... + dy. (4) 


This can be done by means of the composition of 


distributions formula of statistics: 


+@ 
p(z) = fete - x) dx (5) 
=00 


where z = x+y, f is the distribution of x, and g 
is the distribution of y. : 


Figure 1 illustrates the distribution of the 
~m of two random variables, each uniformly dis- 


Fig. 1 - Distribution of z=x+ y. 


tributed from -$ to +4, as found by the above for- 
mila. The result agrees with intuition -- the 
probability of the sum being near -1 or +1 is less 
than the probability of the sum being near 0. 


If we now let f be the distribution we have 
just found for the sum of two variables, and reap- 
ply this formula, we get the distribution of a sum 
of three variables, and so on, to n variables (see 
Appendix). The result of all this is the follow- 
ing: If the deviation of an output can be consid- 
ered as a sum of n uniformly distributed and ap- 
proximately equal random variables, then the prob- 
ability of a deviation falling within an extreme 
nth of the total variation is roughly 1/n}. It is 
clear that this probability decreases as the num- 
ber of components increases. 


Unbalanced Reliabilities 


We now consider a second blind spot of the 
worst-case design philosophy. If the circuit has 
more than one output, there is no indication of a 
possible unbalance of the reliahilities with res- 
pect to each output. A circuit may be designed to 
operate when any particular combination of its el- 
ements are at the limits of their initial toler- 
ances. or end-of-life tolerances, but this does not 
insure that its mean output will be maximally dis- 
tant from all regions of malfunction. 


Related to this is the fact that the nominal 
value of an output (obtained by inserting the nom- 
inal values of the components in the circuit equa- 
tions) is not the same as the mean value of the 
output, intuition notwithstanding. On the con- 
trary, if y = f(x), «+ , X,) and x; are independ- 
ent, the relation between nominal value and mean 
value is given by a Taylor series whose first 
terms ares 
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Note that if the function is linear, mean and nom- 
inal values are the same. 
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Fig. 2 - Simple series 
circuit. 


The discrepancy between nominal and mean vale 
ues is not merely of theoretical interest, con- 
fined to unusual circuits rarely encountered in 
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practice. A close examination of the simple ser- 
jes circuit in Fig. 2 illustrates this difference. 


Let E = 1 volt and R = 1 ohm, and suppose 
that R is uniformly distributed from 1/2 to 3/2. 
In this case the nominal value of I is 1, but the 


Fig. 3 = Unbalance of relia- 
bilities. 


mean value is log 3. The probavility density 
function is 1/12, as shown in Fig. 3. Thus the 
probability of a failure because of too small a 
current is greater than the probability of fail- 
ure from excess current. If a design engineer 
knew of this unbalance, he could compensate for - 
it by choosing R less than 1. 


Measure of Reliability 


A third difficulty with the worst-case de- 
sign philosophy is that it provides no clear 
measure of reliability. An engineer using this 
method will have the satisfaction of knowing he 
has considered reliability, but he will have no 
measure of the effectiveness of this considera-~- 
tion. This is really the key question of the en- 
tire reliability problem. To answer it we need 
the output distribution. This in turn not only 
gives a measure of reliability, but also tells us 
how the output is distributed between its extremes. 


There are several methods in the literature 
for estimating the distribution of the output of a - 
circuit. A rather popular one equates the mean to 
the nominal value, and estimates the standard de- 
viation of the performance parameter y from 

2 n af 2 
6 = —=— 6 . 
(y) ys ie | 
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Then, assuming a normal output, its probability 
density is given by 


_ 5) 
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p(y) = exp (8) 


1 
yore 
This has been called the "propagation of error 


technique," because of the igh LS of Eq (7) 
to computation of precision measures. 


A second method, also using the linearity as- 
sumption, is based on the composition of distribu- 
tions formula, as shavn in Eq. (5). This has the 
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Fig. h - Flow chart for the synthetic sampling method. 


advantage over the propagation of error technique 
because we are not restricted to normal distribu- 
tions. In the study of the extremes of the dis- 
tribution function, the normal curve would have 
been quite unsuitable. Its tails, trailing off to 
too, would have submerged the very thing we wished 
to observe. 


The Method of Synthetic Sampling 


The method that we have found best for ease 
of application, adaptability to available compo- 
nent data, and accuracy is Monte Carlo. In gen- 
eral, the essence of Monte Carlo methods is the 
conversion of a problem to some equivalent statis- 
tical one and then solving this experimentally by 
observing a large REESE of cases. A classical 
example is integration.” Our problem is a natural 
one for Monte Carlo, for it is essentially statis- 
tical to begin with and needs no conversion. For 
this reason it has been called synthetic sampling. 


Suppose we wish to obtain the output distri- 
bution of 


arn f(x,, ooo 9 ea) 


where the x; are distributed in a known way from a 
minimum of x;, to a maximum of x35. We assume 


atl 


that the cumulative distribution function cy of 
the ith component is such that, corresponding to 
any random number between O and 1, there is a 
unique value of the parameter. 


The flow chart for the synthetic sampling 
method is shown in Fig. . The y's are a set of 
test points for the distribution. When the test- 
ing is over, column O will contain all the cases 
less than yo, column 1 will contain the number of 
cases between yp and yj, and so on. Note that the 
y3 need not be equally spaced, but can be chosen 
to highlight any particular region of the distri- 
bution. 


You may ask, what faith can we have in an- 
swers obtained in this way -- by chance, so to 
speak. How do we know that we can trust the ran- 
dom number generator to be unbiased? The answer 
is that there are statistical tests that can be 
and have been applied to these questions and that 
tell us with what confidence we may believe the 
results. Studies of this sort should be part of a 
proper application of the synthetic sampling 
method. 


However, if possible, it is always comforting 
to test the method on a problem for which we know 
the answer. For example, using the composition of 
distributions formula, we have computed the dis- ' 
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Comparison of theo- 


retical distribution for 38) cases with synthetic sampling 


of 38,00 cases. 


tribution of the sum of four variables, each uni- 
formly distributed from 0 to 1. This gave the 
theoretical probabilities for z falling into each 
interval of length $+ from 0 to. The distribu- 
tion was then found Gerpetine nally! A comparison 
is shown in Fig. 5. 


Example 


The method of synthetic sampling has been ap- 
plied to the analysis of the switching circuit 


IcoON + SIcoOFF — 


shown in Fig. 6. This circuit was originally de- 
signed using the worst-case philosophy, in which 
the transistor parameters were taken to end of 
life, and the other circuit parameters were at in- 
itial purchase tolerances. In our testing we let 
all parameter distributions c; be uniform with 
end-of-life limits. Note that any other available 
component data could have been used as well. 


Two performance parameters were considered: 
(1) the voltage difference Ve - V1, when the cir- 
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Fig. 6 - Transistor switching circuit. 
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Fig. 7 = Synthetic sampling, the result of 100,000 cases. 


cuit is on; and (2) Ve - Vp, when the circuit is 
off. For reliable operation these had to be 
greater than zero with some noise allowance. 


Since we were particularly interested in the 
nature of the distribution in the neighborhood of 
zero -=- for this is where failures will occur -- 
we chose our test points accordingly. The results 
of 100,000 tests are shown in Fig. 7. Note the 
unbalance between the on and off cases. When on, 
no case came near failing; when off, 693 cases 
were below the allowed noise level. This was a 
result which could not have been forseen by simply 
considering worst cases. 


In an effort to equalize the on and off cases 
the resistance R3 was decreased from its original 
design value of 2.7 k. As R3 decreased, the on 
case became slightly less reliable, while the off 
case reliability improved. The optimum value ap- 
pears to be between 2.3 k and 2.) k, as shown in 
Fig. 8. With this value, and with the parameter 
distributions we have assumed, the probability of 
failure from parameter drift is 1 in 10,000. That 
is, the reliability is 0.9999. 
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Conclusion 


To summarize, the worst-case design philoso- 
phy says: "Let the circuit operate when the cir- 
cuit parameters have their extreme adverse val- 
ues." In view of the shortcomings of this approach 
already discussed, we propose that it be replaced 
with the design philosophy which says, "Let the 
circuit operate with probability R when the par- 
ameters have their probable values." Synthetic 
sampling seems to be an excellent way to implement 
this philosophy. 


Appendix 


Let us denote the sum of n statistically in- 
dependent variables (each uniformly distributed 
from -3 to +3) by Xm, and the distribution of x 
by fy. The composition of distributions formula, 
Eq. (3) » then gives es. 


,f2 (xe) = , £1 (x) g (x2 - x) .dx (9) 


-@ 


where fj = g, and x) * x. With the distributions 


we have chosen, the independent variables x and 
Xp - X are less than 3 in 


absolute value. Thus 


We are interested in the nature of f,, in the 
neighborhood of its negative extremity, -n/2. 
Clearly, from Eq. (9), 
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Then, by Eq. (5), 
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where f,_ and g are zero outside the ranges 
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Fig. 8 - Failures vs. resistance R3 in 10,000 cases. 
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Differentiation of this gives 


c (x,) mall SS (x1 ee 3) 
and for the (n-2)th derivative we have 


(n-3) 


(n-2) (x + 3) dies FOI 


5 (x) = fn-1 


1) 
Le (x + 22) = fp (x + 2), 


Since f2 (-1) = 0, it follows that f,("-2) 
(-n/2) =,0, and similarly for the lower order de- 
rivatives at -n/2. Also since 


(n-1) 


y n-1 = mee: 
fn (x) = fo (x + so In pha ee > 


we may infer that the order of contact of f(x) at 
the point -n/2, with the x-axis, is n-2. Further- 
more, Since f, is a polynomial of degree n-l, the 
nth order and higher derivatives are all zero. 


All this says, 
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and the probability of falling in this region is 
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which is the result we wished to prove. 


Alternative methods of arriving at the same 
result are given by Silbersteinl3 and Parkerl?, 
The article by Berz*~ is also of interest here. 
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AIR FORCE ELECTRONIC RELIABILITY PROGRAM* 


Je S. Lambert 
United States Air Forcet 


1 As AGREE's Task Group No. 1 has pointed 
out, in the past a manufacturer engaged in the 
development of a new piece of electronic equip= 
ment was confronted with the necessity of meeting 
certain performance requirements. Theoretically, 
he was equally responsible for assuring a high 
level of reliability in his equipment. However, 
the performance requirements were stated in the 
specification or in the engineering exhibit in 
definite and quantitative terms. Thus, the mnv- 
facturer had a legal obligation to meet them. In 
contrast, the reliability requirements were not 
stated in such positive terms. Consequently, re- 
liability was often relegated to a secondary role 
and, if considered at all, it was considered only 
after the equipment design attained the "listed" 
performance requirements. Experience has shown 
rather pointedly that reliability is not necessar- 
ily inherent in any given equipment design, that 
it cannot be left to chance, but that it must be 
considered as a specific performance requirement. 
It must be included in component selection and 
application, and it must be a part of circuit de- 
sign and of the basic equipment development. This 
is especially true of the very complex equipments 
such as SAGE?. 


Several years ago the Air Force became quite 
aware of the fact that its electronic equipment 
reliability was far from adequate to safeguard 
the investment being made in the air vehicles in 
which such equipment was being installed. And 
with the advent of missiles and unmanned aircraft 
electronic equipment reliability has become more 
important than ever before. 


Supersonic flight and the requirement for 
automatic weapon systems of greater and greater 
capability aggrevate the whole problem of equip- 
ment unreliability by: 


(1) Increasing the severity of the environ- 
mental conditions in which the equip— 
ment is expected to work, and 

(2) The greater reliance being placed on 


electronic equipment. 


The more severe environmental conditions result 

in a decrease of performance and reliability of 
the equipment. The greater dependence upon it 
results in the increase in complexity, size, and 
weight. In order to meet the requirements which 
the new air systems impose, the Air Force realized 


* Based on a presentation delivered at the 
Fourth National Symposium on Reliability and 
Quality Control in Electronics, January 6-8, 
1958, washington, D. ©. 


+ Air Research and Development Command, Andrews 


Air Force Base, Maryland. 
+ Semi-Automatic Ground Environment. 
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that any program of equipment development had to 
be backed up, not only by a sound and logical pro- 
gram of component part development, but also by a 
program of component packaging and assembly, heat 
transfer, weight and size reduction, increase in 
circuit performance, and in general in the improve- 
ment in the reliability of equipment operation. 

In order to give the reliability require- 

ment sufficient weight and priority, the Air Re- 
search and Development Command (ARDC) issued in 
mid-1956 Technical Requirement No. 206 entitled, 
“Electronic Design Techniques.” Its goal is to 
attain, by means of specific development effort, 
equipment design which will provide maximum over- 
all performance and reliability per minimum of 
weight. This development directive required the 
ARDC development centers to establish specific 
projects which would advance the technology of 
electronic equipment reliability. This was to be 
accomplished by the advancement of techniques that 
would lead to: 


Simplification of equipment design 
which would take full advantage of 
packaging and assembly, shielding, 
cooling, improved form factors, heat 
dissipation and/or absorption, and 
component derating 


(1) 


(2) Derivation of design and trade-off 
curves which would represent the rela- 
tionship between performance, reliabil- 
ity, complexity, form factors and other | 
features of the equipment, the design 
data to be developed and presented in 
such a form that an engineer can favor 
the factors pointed up by the operation- 
al requirement stated for the equipment 
he is developing 


(3) The calculation of performance, relia- 
bility, weight, size and ruggedness of 
the equipment before it is built, and 
the verification by simple tests of the 
correctness of the calculations after 


construction of the equipment 


Circuitry which would provide mainten- 
ance free equipment for at least 1,000 
hours of continuous operation 


(4) 


Automatic fault location and marginal 
checking devices for incorporation in- 
to the equipment to indicate impending 
failures and for the rapid isolation 
of failures should they occur 


(5) 


Circuitry to avoid complete equipment 
failure in case of failure of one com— 
ponent part 


(6) 


Establishment of correlation between 
laboratory and production type tests 


(7) 


and expectancy of operational reliabil- 
ity 


(8) Development of abbreviated quality con- 
trol tests. 


As a result of this directive, projects were 
established at the ARDC centers to develop more 
rugged components, more reliable circuitry, and 
improved quality control procedures. Mathematical 
studies have been started which, using the theor- 
ies of probability and statistics, should result 
in a sound and comprehensive procedure of relia- 
bility analysis and synthesis. In other words 
a technique is required which, given the reliabil- 
ity and tolerance distribution of the components, 
would guide the designer in achieving the quanti- 
tative reliability expected of the specified item 
of equipment. This technique should also enable 
engineers to evaluate partial or completed equip- 
ment designs and to determine rapidly whether the 
equipment will meet the operational reliability 
figures quoted in the specifications. 


Comparisons are being made (and this work 
is just beginning) between actual field reliabil- 
ity figures and theoretical and empirical predic- 
tions based on theories in development. Modifi- 
cations of the prediction techniques will continue 
to be made until their results correlate closely 
with field reliability data. Several methods of 
predicting reliability are being tried, such as 
complete and detailed system's analysis, part 
count and use of environmental stress curves, and 
sampling. Test procedures are also being devel- 
oped to verify whether the specified reliability 
figures so obtained have been met in the equip-— 
ment design. 


Work is under way to determine representa- 
tive quantitative reliability figures for several 
classes of Air Force equipments which could be 
used in development exhibits and production speci- 
fications. This work should also aid in determin- 
ing reliability requirements which could be in- 
cluded in component parts specifications, the 
problem that Mr. Child pointed up in his paper”. 
Some of the representative Air Force equipments 
on which studies are being conducted to determine 
the mean-time-to-failure are the following: 


(1) AN/GRC-27, UHF ground communication set 
(2) AN/FPS-3, ground early warning radar 


(3) AN/UPX-6, ground identification trans- 
mitter-receiver for the Mk X System 


(4) AN/MSQ-1, tactical control radar 


(5) AN/ARC-34, airborne UHF communication 
set. 


The preliminary analysis conducted on the 
GRC-27, minus the guard channel and under a typi- 
cal 4:1 receive-transmit operating ratio, indicates 
a mean-time-to-failure of 399 hours. The mean 
life of the FPS-3 is 74 hours and that of the 
MSQ-1 about 30 hours. 
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The obstacles to overcome in completing this 
work are rather imposing. For example, it is dif- 
ficult to determine the quantitative figures, if 
any, that should be assigned to such intangible 
effects as operator skill, maintenance level, en- 
vironmental conditions, and so on. 


Any reliability improvement program to be 
effective requires a good feedback procedure; 
otherwise it would be impossible to compare the 
theoretical reliability predictions with actual 
field reliability results. AF T.0. 00-202, 
“Malfunction Data Recording for Armament and Elec- 
tronics Equipment" published 20 May 1957 provides 
a directive for acquiring and recording electronic 
equipment behavior and malfunction data. The pur-. 
pose of this directive is to obtain information 
on airborne armament and electronics equipment in 
order to institute corrective action, but it should 
also serve to provide a failure reporting proced- 
ure. The current field failure reporting system 
in the Air Force has not proved too satisfactory 
for the following reasons: 


(1) Not all failures are reported 


(2) There is no indication as to the total 
number of equipments covered by the 
reporting system 


(3) Equipment running time is often not 
recorded 


(4) Data is not processed fast enough. 


Definite measures are being taken to im— 
prove this system. One of them is the develop— 
ment of a running time meter called the chronister. 
It consists of a fuse like device containing cop- 
per sulphide, a fuse holder and a current limit- 
ing resistor. The fuse like device and resistor, 
connected in series, are placed in the equipment 
so that a current of one milliampere flows thru 
them when the equipment is operating. The amount 
of copper deposited at one of the electrodes can 
be read in terms of equipment running time up to 
1,000 hours. In addition other ways and means 
are being considered to have the data recorded 
more accurately and processed more promptly. 


Perhaps one of the major concentrated ef- 
forts in improving the reliability of any single 
system so far has been the work on SAGE, the Semi- 
Automatic Ground Environment of the Air Defense 
System. It was realized early in the develop-— 
ment stage that the keystone to successful opera- 
tion of SAGE lay in the reliability of component 
parts and circuits. This was in particular true 
of the central digital computer, AN/FSQ-7, as it 
has: 


(1) Over 50,000 tubes of about 25 differ- 
ent types 


(2) Over 170,000 diodes 
(3) 547,000 resistors 


(4) 189,000 capacitors. 


Reliability of the computer has been im- 
proved by a number of measures some of which are 
the following: 


(1) Duplex operation of the basic com- 
puter elements and the employment of 
operational spares in the case of sim- 
plex equipments 

(2) Development of superior component 
parts such as the ultra-reliable 
electron tubes having a life span of 
100,000 hours 

(3)  Applicstion of components through 
circuit designs that extend compon- 
ent life to the maximum 

(4) Marginal checking techniques, in this 
case a built-in capability, for the 
purpose of predicting and weeding 

out components which with time develop 
a high failure probability. Also the 
formulation and preparation of test 
programs which exercise the machine 

in rigorous electrical patterns in an 
effort to precipate or predict poten- 
tial component failures 

(5) Unit test equipment together with 
facilities for loop-tests 


(6) 
(7) 


Built-in alarms to isolate failures 


Packaging techniques that facilitate 
maintenance 

(8) Provision of the proper operating en- 
vironment for components from the 
standpoint of temperature and humidity 
(9) Circuit designs which minimize the 
effects of component aging. 


Reliability improvement of SAGE continues. 
This consists of pinpointing and replacing trou- 
blesome components and improving marginal check- 
ing and marginal test equipment. Studies are be- 
ing conducted to prescribe meaningful margins to 
detect insipient component failures. 


What has just been described could be con- 
sidered as the first phase of the Air Force elec- 
tronic reliability program, or that phase which 
leads to the advancement of the state-of-the-art. 
The second phase, concurrent with the first, is 
pointed toward increasing equipment reliability 
as this equipment undergoes development. Its ob- 
jective is the inclusion of a definite reliability 
requirement in all equipment production specifica- 
tions. 


Several years ago the Air Force concluded 
that the only way basic equipment reliability 
could be improved was to include reliability as 
one of the factors that had to be met in the ini- 
tial equipment design. As a result, this require- 
ment was stated in ARDC Regulation No. 80-21 pub- 
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lished on May 16, 1956* as a directive to be fol- 
lowed by all ARDC centers. This regulation states 
that reliability must be considered as one of the 
major requirements of engineering design in all 
phases of research and development of electronic 
equipment. It also states that all specifications, 
exhibits, product descriptions or other technical 
requirement documents will include as one of the 
major engineering factors specific requirements 
covering reliability. These requirements must be 
stated in quantitative terms consistent with the 
state-of-the-art and in consideration of the other 
design factors such as maintainability, cost, ver- 
satility, procurability, standardization, perform 
ance, etc. It also specifies that deviation from 
specified quantitative reliability requirements 
will be granted only after it has been determined 
that trade-off values justify such action in order 
to gain the desired degree of performance in some 
other area of consideration or to:obtain a bal- 
anced overall end result. It specifies that one 
of the major factors in the evaluation of any con- 
tractual proposal will be a review, from an engin- 
eering standpoint, of the adequacy of the reliabil- 
ity program that the prospective contractor pro- 
poses to follow. Such an evaluation will include 
the following: 


(1) Inspection and quality control methods 

(2) Functional and environmental test pro- 
cedures 

(3) Analysis procedures and methods used 


to predict and measure reliability. 


During the course of an equipment develop- 
ment contract, separate progress reports, or a 
separate chapter in each progress report submitted, 
will be required which will state clearly and con- 
cisely the contractor's efforts to achieve relia- 
bility and will show his accomplishments. The 
final report will show: 


(1) The predicted reliability of the equip- 
ment 
(2) Features of the equipment design con- 
sidered weakest from the standpoint 
of reliability 
(3) Measures taken to increase reliability 
(4) Improvement attained by measures taken 
(5) Conditions which might decrease relia- 


bility. 


Shortly after this regulation was published, 
the development centers put out their own instruc- 
tions enforcing this policy. Since then a number 
of general specifications have been written to cover 
a specific class of equipment. For instance: 


(1) WADC's Exhibit No. WCLN-1308 of 16 Ap- 
ril 1956 whose purpose is the estab- 


* Preliminary instructions were issued several 
months before this date. 


lishment by: the contractor, during 
the development stage, of a comprehen- 
sive reliability program covering air- 
borne communication, navigation and 
identification (CN&I) equipment 
(2) .WADC's Exhibit No. WCLR-453, dated 
16 October 56, which covers the pro- 
cedures and criteria required to as— 
sure an adequate program for obtain- 
ing reliability of airborne reconnais- 
sance equipment during the final devel- 
opment stage and prior to the produc- 
tion program. 


These exhibits require the contractor to 
establish a definite reliability program. Since 
4t is not often possible to prove statistically 
that a specified reliability level has been achieved, 
it is necessary to judge results from the proper 
application of certain criteria and procedures. 
Therefore, within 90 days after the date of the 
contract, the contractor is required to submit his 
proposed reliability program for approval. This 
includes the circuit design and the computations 
on the statistical estimate of the probability 
that the equipment will operate for a stated num- 
ber of hours without failure or fault. Trade-off 
values between the performance of the equipment 
and its associated design characteristics (fre- 
quency, range, power, accuracy, etc.) must be bal- 
anced against reliability. Im addition trade-off 
values must be considered from the standpoint of 
maintainability, cost, versatility, procurability, 
standardization, time scheduling, etc. 


Other more general type of specifications 
such as RADC's MIL-E-4158, "Requirements for Ground 
Electronic Equipment", are being changed to include 
reliability requirements. Standard paragraphs are 
also being prepared for inclusion in equipment 
specifications. 


Engineering groups have been appointed for 
the purpose of reviewing and making recommendations 
for improving the reliability program of the par- 
ticular agency they represent. One such a group 
is the Intercommand Communications-Electronics Re= 
liability Comnittee; another, but on a lower level 
has been established in the Weapons Guidance Lab-— 
oratory of Wright Air Development Center. 


With one exception which is being checked, 
all Air Force electronic equipment exhibits which 
have been written during the past year have included 
a reliability requirement. These are mch more . 
specific than the general type of specifications 
and spell out in detail the service life and relia- 
oility of the particular equipment and how to test 
for these factors. In cage of lack of any other 
instructions, MIL-R-25717" is being used to estab- 
lish the minimum reliability program. Some of the 
equipment specifications which now include relia- 
bility requirements are: 

(1) WADC's Exhibit WCLN-1314 for AN/ARN- 
52(XA-1) dated 4 May 56 which includes 
a& requirement that the equipment have 
a reliable statistical average operat- 
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ing life of 200 hours without the re- 
placement of any components or read- 
justment of the equipment 


MIL-R-64,71A(USAF) specification for 
AN/ARC-21 dated 9 October 56, This 
also requires the equipment to aver=- 
age 200 hours of operation between 
failures, without servicing; replace- 
ment of electron tubes is considered 
a failure. 


(2) 


Although the recent AGREE task group re- 
ports have been of great help, one of the big prob- 
lems that still remains to be solved is the deter- 
mination of quantitative reliability figures for 
the many Air Force equipments being procured, and 
the development of testing techniques and/or test 
equipment to determine if these figures have been 
met. 


The third phase of the Air Force program 
covers the improvement of the quality of replace- 
ment parts. Since electron tube failures cause 
the greatest number of equipment failures, both 
the Air Materiel Command and ARDC have issued reg- 
ulations which require, in the development and pro- 
duction of Air Force equipment, the use of the best 
quality and most rugged electron tubes available. 
ARDC Regulation No. 80-24 entitled, “Use of High 
Quality Electron Tubes in the Development of New 
Equipment", states that under no condition will 
an older type of tube be used if an improved tube 
type is available, This policy is now in the pro- 
cess of expansion to the opereting commands. A 
dreft Air Force regulation is in the process of 
coordination. It will require all Air Force agen- 
cies to use the highest quality tubes not only in 
development and production but also in the mainten- 
ance of ‘Air Force equipment. It is the Air Force 
plan to expand this policy so that it will cover 
other component parts. 


It is the Air Force feeling that any ad- 
vances made in reliability will be of limited val- 
ue unless they are put into practice. Therefore 
the Air Force directives also require the dissen- 
ination of the design data to electronic equipment 
developers to make them aware of the advantages 
that the new design techniques offer. As a result 
several general references on electronic equipment 
reliability or related.to it have been published. 
Some of them are: 

(1) “Reliabi tty Factors for Ground Elec- 
tronic Equipment" published first as 
a report in 1955, then as a book by 
McGraw-Hill Book Company“, However, 
in the last two years the reliability 
field has progressed so fast that the 
handbook already requires revision. 
(2) “Techniques for Application of Electron 
Tubes in Military Equipment™, published 
as a WADC Technical Report first in 
January 1955 and revised in October 55, 
(3) Volume I of 3 of “Techniques for épli- 
cation of Electronic Component Parts 


in Military Equipment", published in 
January 1957 as WADC Technical Report 
57-1. The next volume should be ready 
for distribution at the end of January 
1958 and the last one by mid-1958. Al- 
though published by the Air Force, the 
Army and the Navy contributed a large 
portion of the information. 


In summary the Air Force reliability program 
consists of several concurrent phases. The first 
can be termed as "advancing the-state-of-the-art"; 
the purpose of the second is to modify all equip- 
ment specifications so that they will include de- 
finite reliability requirements and methods of eval- 
uation to show whether these requirements have been 
met. The goel of the third phase is to insure the 
use of the best component parts in the maintenance 
of Air Force equipments. 
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RELIABLE DESIGN AND DEVELOPMENT TECHNIQUES 


By J.E. McGregor 
International Business Machines Corporation 
Kingston, New York 


Summary 


Mechanical concepts must be applied to modify 
electronic circuit design in order that large scale 
computer equipment can attain practical levels of 
reliability. This paper cites some specific mechan- 
ical design problems with regard to the reliability of 
a particular computer system, the AN/FSQ-7. 


Introduction 


Electronic components, no matter how good 
their quality, will not perform properly unless 
placed in suitable environments. Military specifi- 
cations are explicit with regard to operating con- 
ditions or performance guides to ensure reliability, 
but they cannot cover special problems which arise 
from particular circuit designs. Therefore, the 
mechanical engineer must derive a unique solution 
for each new problem. 


Prior to the actual mechanical design, the 
engineers, designers, and draftsmen must clearly 
understand the system aspects of the particular re- 
liability problem they are attempting tosolve. They 
must be aware of the effect the solution to their 
problem will have on the overall system with regard 
toreliability and possible electronic design changes 
caused by mechanical modifications. They must be 
sure that any modification they may request will 
not place the operation of the computer system 
outside the allowable specification limits. Mechan- 
ical designers should, therefore, be furnished with 
detailed specifications which have already been 
reviewed by reliability personnel in a systems 
group. 


Portions of these specifications shouldbe pre- 
pared by mechanical engineers who strive to an- 
swer essential design questions as completely as 
possible ahead of time. These questions would 
concern levels of pluggability, details of circuit 
package construction, method of power distribution, 
module layout and arrangement, environmental 
conditions, back panel wiring and cable termina- 
tions, cooling system construction, and locations 
and style of test points and indicators, 


The mechanical engineer must consider the 
overall reliability as well as the overall purpose 
and functions of the system. For example, in pro- 
viding a rotating magnetic fieldfor a cathode-ray 
display tube, he may finda simple mechanical 
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system will have higher reliability than an all-elec- 
tronic system requiring a large number of tubes 
and components. The mechanical system has the 
added advantage of being far more predictable with 
regard to performance, life expectancy, and envi- 
ronmental conditions required to perform a speci- 
fic function. 


Specific Design Problems 


The specialized nature of the AN/FSQ-7, and 
the Air Defense System for which it was built, 
caused specific design problems which had to be 
solved within the needs of the system. 


Mapper Console 


Adisplay mapper console was designed to show 
target information generated at a remote radar site. 
Information is transmitted over telephone lines to a 
cathode-ray tube inthe mapper console. Since the 
cathode-ray tube deflection coil and a magnetic 
drum in the mapper console must be driven in 
synchronism with the radar antenna, they myst re- 
pond instantly to changes in angular velocity caused 
by wind effects on the antenna. 


The maindesign difficulty lies in the fact that 
only limited power is available over the phone lines 
to drive the components inthe console. For relia- 
bility purposes, the tube count in the amplifier 
must be kept to a minimum; therefore, the maxi- 
mum torque available to the synchronous drive 
motor is only seven ounce-inches. One pulse per 
motor revolution is available from the phone line. 
Drive power is so low that auxiliary 60-cycle 
power, controlled by a centrifugal switch, is used 
to put the unit: into operation. 


The input mechanism includes a synchronous 
drive motor, a centrifugal cutout switch, the mag- 
netic drum, three magnetic brakes, two differen- 
tials, a photo-cell timing slit, a cam-operated 
switch, reduction gears, a universal drive shaft, 
and the deflection coil. The total inertia reflected 
by the complete system tothe drive motor is 0.632 
ounce-inch-seconds“. 


Friction. Because of the low torque available, 
the friction within the system must be kept to a min- 
imum. The problem of reducing friction is further 
complicated by the undesirability of using a gear 
tooth lubricant. Possible contamination of the lub- 
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ricant could increase friction and could hamper the 
operation of the photo.cell in the gear box. 


To ensure that friction will not increase during 
the 10-year life expectancy of the gear box, an un- 
usual gear design was chosen. By using hardened 
stainless steel gears with an exceptionally smooth 
tooth finish, it is possible to keep friction torque 
down to a value of 2.8 ounce-inches, leavinga safety 
margin of 2.5. For gear material, type 440-F-SE 
stainless steel was selected. All gearing is class 2 
precision, and the gears are hardened to Rockwell 
C-60. The gear teeth are formed by grinding to a 
surface finish of eight micro-inches. Fifty class 5 
ball bearings, supporting all rotating parts, are 
pre-lubricated with Andok-C grease, which has a 
predicted life of 10 years and fulfills the lubricant 
requirements. 


Accessibility. Since the mechanical transmis- 


“sion has a life expectancy of 10 years or 100,000 


hours operating time, the equipment had to be de- 
signed so that the short-lived photo-cell tube was 
easily accessible. Therefore, the photo cell was 
mounted near one side of the gear box, and a special 
easy-access opening was provided for it, allowing 
an exceptionally short replacementtime. The gear 
box cover plate was sealed with a rubber gasket to 
protect the unit from dust and other contamination. 


Thirteen of these transmission units, com- 
prising approximately 3,000 individual mechanical 
components, have had a total operating time of 
200,000hours to date. No serious malfunction has 
developed, and performance is satisfactory. 


Repair and Replacement Time. An important 
consideration in reliability is the time lost for 
repair and replacement of components. As a first 
approximation, halving repair time has the effect of 
doubling mean free time between failures in a duplex 
system. This is where the mechanical engineer can 
make a major contribution. For example, one of 
the problems encountered in replacing the rela- 
tively short-lived cathode-ray tube in a mapper 
console is the adjustment time required to line up 
the deflection coils. 


The particular tube used in this console has a 
close tolerance metal shell at the face end of the 
tube and a large-tolerance blown-glass neck. The 
center line of the neck has six degrees of freedom 
with respect to the axis of the metal shell. The 
design used to minimize tube replacement time 
uses three axial springs, a sliding plane surface, 
and a spherical seat to give the deflection coils 
the required six degrees of freedom. 


After the tube is placed in position, a hand 
wheel is rotated to lock the moving surtaces to- 
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gether. Tube replacement time is about three 
minutes since there are no time-consuming, 
difficult-to-reach adjustments to be made by the 
technician. 


The components inthe mapper console are de- 
signed to be replaced in their entirety. Replace- 
ment time is short since disassembly and reas- 
sembly procedures are extremely simple. 


Circuit Packaging 


The selection of the proper package will make 
afirm foundation for building computer reliability 


and maintainability. Specific design problems re- 


volving around these factors will illustrate this 
point. The package elements should contain a 
single basic circuit to make testing and trouble 
shooting easier and to permit. greater standard- 
ization. The basic packages should, be grouped in 
integral blocks so that failures can be traced to a 
single block. These building blocks can easily be 
replacedif they are designed to be pluggable, thus 
keeping computer downtime under 15 minutes. This 
ease of replacement is essential if a 10-day mean 
failure-free rate, or better, is to be achieved in 
huge systems like an Air Defense Control Center. 
Inabasic package, lines are made as short as 
possible, the number of electrical joints used is 
kept low, andcomponent leads are straight to make 
manufacturing easy. Additional design features 
allow for replacement of defective components 
individually. Heat-generating components are 
separated from temperature-sensitive components 
as much as possible. 


An assembly comprising a basic circuit 
package called a ''Q-PAC" ‘is shown in figure 1. 
Inthe lower section are R and C components which 
may or may not be potted, depending on the heat 
transfer system and the environment. Diodes are 
in the next higher layer and are protected from 
heat by a reflecting surface. Transistors, which 
can be replaced individually, are clip-mounted to 
a plate that provides shielding and acts as a heat 
sink. Heat is carried off by four corner posts as 
well as by radiation to a cold plate cooling unit. 


The basic circuit packages are plugged intoan 
aluminum framework called a pluggable unit or 
logic block (fig. 2). The framework carries off 
heat to the cold plates next to the pluggable unit. 
The cold plates have a temperature of 58° Fahren- 
heit, and component body temperatures are kept 
below 80° Fahrenheit. The pluggable unit serves 
asa structural member andprovides ground planes 
and shielding for the basic circuits. 


The bus bars distribute supply voltages, and 
shielded conductors serve as signal lines. Twisted 
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Fig. 2 = Pluggable unit assembly, front view sho 


2h 


‘pairs of wires are used for critical or noise-sus- 
ceptible lines (fig. 3). 


Memory Drum Design. 


Good mechanical design can have a strong in- 
fluence on memory drum reliability. Important 
factorsto be considered here are head adjustment 
and bearing replacement. 


Drum reliability cannot be fully guaranteed by 
proper arrangement and use of pre-lubricated 


sealed-for-life bearings. However, if the read- 
write heads are designed so that they do not have 
to be readjusted each time the drum is replaced, 
the reliability will increase as a result of less 
downtime. 


Read-Write Head. The shoe ofa floating read- 
write head is supported by a film of air surrounding 
the moving drum surface. The support force is gen- 
erated by the moving air film, which circulates 
with the moving drum surface (fig. 4). This force 
is similar tothat producedby hydrodynamic effects 


Fig. 3 - Pluggable unit assembly, rear view showing wiring. 
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Fig. 5 - Magnetic-head cross section. 


in ordinary lubricated bearings. Down loads from 
the head coil and laminations are balanced by the 
aerodynamic lift sothat a small clearance is always 
maintained between the drum surface and the shoe. 


The shoe is supported by a flexure plate so it 
has three degrees of freedom (fig. 5). It cannot shift 
out of its assigned track on the drum, but it is free 
to move radially with respect to the drum. Air 
pressure applied to the diaphragm forces the shoe 
downward until it is in balance with the upward force 
from the drum surface. Since the shoe is balanced 
and flexible, it can compensate for sizeable radial 
eccentricities in drum movement. 


Whenever the drum stops rotating, reduction 
in air pressure through the air delivery opening 
causes the shoe to spring upward and not touch the 
drum surface. Once the drum is put back into oper- 
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ation, the head is automatically positioned and 
ready. Since previous designs required a head- 
adjustment time of four to six hours, this repre- 
sents a major reduction in downtime. 


The entire drum rotor assembly can be re- 
placed in less than15 minutes since the new rotor 
assembly does not have to be critically matched 
to the former installation. 


Conclusion 


After a specific electronic design is created, 
the mechanical engineer must solve the attendant: 
problems of friction, lubrication, accessibility, re- 
pair and replacement of components so that prac- 
tical levels of reliability may be attained in com- 
puter systems. 


THE NAVY SPECIFICATION PROGRAM FOR RELIABILITY 


E. J. Nucci 
Bureau of Ships 
Department of the Navy 

Washington, D. C. 


The objective of this paper is to 
simply relate to you the role of the 
specification in the Navy's Electronics 
Reliability Program over the past years 
end to outline what appears to be the 
specification aspect of reliability 
for the future. In my discussion I 
will deal for the’ most part with full 
equipments and systems reliability and 
specifications. 


The Navy, as one of the services of 
the Defense Department is essentially a 
consumer agency. Yes, we have research 
and development. laboratories; however, 
we must look to industry for a good part 
of our research and development and for 
sll of our production needs. As a 
consumer sgency we. find ourselves in 
the procurement business and the speci- 
fication becomes the important tool and 
communications link between ourselves 
and the contractor, design agent and 
manufacturer. This communications tool, 
the Specification, must contain and 
reflect all of the good engineering 
required, it must reflect realistically 
and practically all of the new design. 
techniques and reliability techniques 
developed as a, result of special develop- 
ments, special studies and past 
experience. it.was once stated and I 
believe rightly so, quote "The only real 
product of the design groups at the 
material bureaus is the specificatton 
with its attendant follow-up to assure . 
adherence thereto." 


At this point I wish to make a 
statement which is the fundamental 
philosophy to the Navy's approach to 
reliability. The attainment of. reli- 
ability in our. electronics equipment 
cannot be had by pronouncing the magic 
word or by simply stipulating in a 
contract clause or special separate 
specification that we require maximum 
reliability. On the contrary, the : 
‘attainment of reliability is a matter 
of establishing realistic, practical 
design requirements reflecting available 
parts and materials, circuit techniques, 
mechanical and thermal design techniques. 
All of these shall be in consonance with 
manufacturing techniques. Once this 
specification aspect is complete it 
becomes the basis from which the 
designer and manufacturer can work to 
achieve the reliability required. It 
will be only through the good solid 
engineering of the designer, the ability 


of the manufacturer to build to the 
designer's detailed requirements that 
the inherent reliability is attained. 
So, we might say that "Inherent 
Reliability is a function of the basic 
design specification, the engineering 
executed by the designer and the work- 
manship and. ability of the manufacturer 
to transform design requirements into 
the physical piece of equipment." 


With this philosophy as a back- 
ground the Navy's efforts have always 
been to reflect new materials, parts, 
techniques into their general specifi- 
cations. Newly developed concepts are 
included in the general specifications 


or into the individual equipment 


specifications. Environmental design 
criteria is under constant surveillance 
such that specification requirements 


' reflect the fleet operating environments 


rat 


as. closely as is possibie. 


RELIABILITY EFFORTS 


Reliability is not a new effort 
with Pie Very atta ao eee 
history we will find many instances of 
specification changes to cope with 
naval environments. I'd like to relate 
my discussions to time period of 1938 
to 1949; the recent Defense Department 
Reliability effort from 1949 to this 
date and then deal with 1957 and the 
future... ; 


- Period of 1938 to 1949. In the 
1938 to 1949 era we saw the design of 
shock and vibration, as well as incli- 
nation machines, developed to simulate 
shipboard conditions. Then the Navy 
led a program to redesign commercial 
tubes to meet these stringent mechanical 
tests. In the latter war years we saw 
the Navy tube ruggedization program to 
obtain what was referred to as rugged- 
ized JAN tubes. As these developments 
became available, they were required in 
revisions to our general specifications. 
It is interesting to note that in the 
past few years much has been said about 
the failure rate curve or failure pattern 
of equipments, parts and tubes. Early 
failure rates and debugging, constant 
failure rate region and wear out region 
are terms of the past few years. With- 
out this more scientific background the 
Navy experienced a nasty problem in the 
early war years. The sonar equipments 


installed in the fleet experienced very 
high failure rates in the first few 
months of operation. As an emergency 
corrective measure, the general speci- 
fication was amended to call for a new 
continuous operating twenty-one day life 
test for all prototypes. The object of 
the test was to debug the prototype, to 
detect the marginal circuits and parts. 
This was found to be very effective. 
The 1946-1951 period saw another con- 
centrated effort on increasing the 
reliability of tubes and in 1952 the 
requirement for use of the higher 
quality Navy Reliable tube line in all 
new Navy electronic equipments. 


Period of 1951 to 1957. The era of 
1951 to date we might say was an era of 
increased emphasis in reliability with 
the U. S. Navy. The effort was planned 
and coordinated in implementation of 
recommendations of the Ad Hoc Group on 
Reliability of Electronics Equipment 
published as the Progress Report on 
Reliability of Electronics Equipment 
18 February 1952. (This group later 
became the Advisory Group on Reliability 
of Electronics Equipment (AGREE) pre- 
sently sponsored by the Office of the 
Assistant Secretary of Defense (R&E)). 
The 1952 to 1956 era saw a rigorous 
review of electronics specifications 
-with reliability as a basic objective. 
For example let us review the Bureau of 
Ships Specification Effort. 


(A) With respect to specification 
for design MIL-E-16400 "General 
Specification for Electronics 
Equipment (Ship and Shore)" 
This specification represents 
a drastic revision of specifi- 
cation 16E4. 


(1) Environmental criteria were 
carefully revfewed to make 
design requirements more 
realistic. In lieu of all 
design for the entire excur- 
sion of -54°C to 465°C, four 
temperature classes were 
established: oe 


Class 1. -54%% to +65°C for 
*"  .Shore Exposed Equip- 
* ment 

Class 2. -28°C to 465% for. 
Shipboard Exposed 
Equipment — 

Class 3. -40°% to +50° for 
Shore Sheltered but 
Unheated Installa- 

- tions 

Class ¥. -0°C to «50° for 
Ship/Shore Housed 
and Heated Instal- 
lations. 
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(2) 


(3) 


a 


The new MIL-STD-242 (Ships) 
became a part of MIL-E-16400 
to indicate Selected 

Standards and Preferred Parts. 
This document. included new 
commercial parts approved for 
use but not cdvered by 
military specification due 

to time required to establish 
enough items to write a 
military specification and 
also to complete coordination. 
This document algo includes 
application data. MIL-STD- 
242 is presently being made a 
tri-bureau (ORD/AER/SHIPS) 
document. 


The new line of higher 
quality Navy Reliable Tubes 
were introduced into this 
specification many months 
prior to complete tri-service 
coordination on tube require- 
ments. 


The environmental tests were 
very carefully reviewed 
against environmental cri- 
teria to establish temper- 
ature tests to simulate 
closely actual environments. 
The twenty-one day life test 
called the Accelerated Life 
Test was shortened to 15 
days; however, truly acceler- 
ated features were introduced: 


Test at high temperature, high 
humidity, cycling of plus and 
minus input voltage and even a 
periodic 15 minute break to 
introduce thermal shock on 
tube filaments. 


. in general all tests were 
revised not necessarily to 
make requirements more rigid 
but to. better simulate ser- 
vice conditions and to obtain 
greater assurance of reli- 
ability. 


Later revisions saw the 
following added to the 
specification J 


(a) Stipulation of 
Standard Preferred 
Circuit Voltages 


(bd) Stipulation of 
Preferred Circuits: 


(c) Preferred Dimensions 
for Modules of 
Modular Construction 


(a) 


Introduction of 

Transistors 

(e) Introduction of 

voltage and fre- 

quency transient 

condition require- 

ments 

(f) Reference to Design 
Guide Documents such 
as "Guide Manual of 
cooling methods of 
Cooling Electronic 
Equipment NAVSHIPS- 
900-190", the "NEL 
Reliability Design 

’ Handbook," the 
"Preferred Circuits 
Menual NAVAER-16-1- 
519" 


In order to establish a 
specification which is more 
realistic and compatible with 
manufacturing techniques 
draft copies were forwarded to 
industry for comment prior to 
printing. 


(B) Other General Specifications 


There were other areas 


where new general specifications 


were needed and established; 
such as; 
(1) MIL-E-17555 General Specifi- 
cation for Packaging and Pack- 
ing Electronics Equipment and 
Parts. 


MIL-E-17362 "Military Specifi- 
cation, Electronic Maintenance 
Parts Requirements" to simpli- 
fy parts provisioning and 
insure adequate spares for 
first deliveries. 


(2) 


MIL-E-19100 "General Specifi- 
cation for Electronics Ship- 
board Trainers". 


(3) 


The Bureau of Aeronautics recently 
issued Specification MIL-E-19610. This 
specification was a determined positive 
effort to insure reliability in airborne 
equipments. It established reliability 
in terms of number of hours of equipment 
operation with no failures or with a 
specified minimum number of failures 
permitted. Rigid test requirements were 
established to obtain a measure of 
assurance. Very rigid incoming inspec- 
tion tests and burn-in procedures for 
parts and tubes were devised to overcome 
inadequacy of parts inspection tests and 
poor quality control procedures. 
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Recently the Bureau of Ordnance, 
prior to the issuance of the AGREE Re- 
port, instituted 9 reliability program in 
a weapon system being developed. The 
program required a vigorous reliability 
effort throughtout the development in- 
cluding theoretical and experimental 
approaches. It utilized AGREE Task 
Group 4* procedures as the basis of the 
reliability effort. A similar action was 
teken by the Bureau of Ships wherein the 
procedures of Task Group 4 were included 
in a development contract for a trans- 
mitter-receiver as a trial implementetion. 
More will be said about the AGREE pro- 
cedures later in the paper. 


I'd like now: to ask 
the $64, question. What about the 
mbheonay Isbadicneilye abi aks) Galen Oeue 
General specifications will introduce: 


(a) 


Future Plans. 


Quantitative Reliability 
Requirement 

(b) Improved equipment testing 
techniques, including statis- 
tically designed tests to prove 
compliance with the reliability 
quantitative requirement. 

(c) More specific design criteria 
for improved Maintainability. 


"THE PROGRAM FOR AGREE" 


As you all know, the results of 
almost 1060 months of effort by nine Task 
Groups on the "Program for AGREE" was 
recently published as the Report by the 
Advisory Group on Reliability of Elec- 
tronics Equipment (OASD-R&E) entitled 
"Reliability of Military Electronics 
Equipment - 4 June 1957." The overall 
program was directed at a method of 
stipulating or specifying the level of 
reliability in a procurement document, 
in quantitative terms. This report was 
recently forwarded to the military 
departments for initial implementation. 
Gentlemen, we sre on the brink of a newera! 


From here on in we will treat 
Reliability like any other technical 
requirement of an equipment or system; 
such as power output, receiver sensitivity 
accuracy, frequency stability - and 
reliability - all to be specified in 
quantitative terms and tested to the 
assurance required. 


Thus, the impact of the AGREE Report 
and the following actions are planned. 


* Advisory Group on Reliability of Elec- 
tronic Equipment (AGREE) Report on Re- 
liability of Military Electronic Equip- 
ment (OASD-R&E) dated 4 June 1957. 


1. Ultimetely Reliability levels 
will be specified in all equipment con- 
tracts. Initial implementation will be 
yn a selected basis and more or less con- 
fined to development contracts to gain 
experience and knowledge on the adequacy 
of the techniques. 


en Thesresults. of lack Groupsr. 
and III are essentially the test plans 
that will be employed. These sre based 
on sequential test techniques to verify 
compliance with the reliability level 
specified. Task Group II presents a 
plan for development or prototype models 
whereas Task Group III test plans apply 
to Pilot Line and Production Equipments. 
It is anticipated that these Test Plans 
will be edited and put into specification 
form for use in contracts. There are 
plans to include these test procedures 
in a handbook being sponsored and 
coordinated by the Office of the 
Assistant Secretary of Defense (S & ils 
This handbook will contain sampling 
procedures for life and reliability 
testing. These test procedures will in 
all probability supersede the BUAER 
equipment reliability test procedures 
mentioned above as part of specification 
MIL-E-19610. 


3. Task Group IV established a 
"Procedure for Design and Development to 
Insure the Required Inherent Reliability. 
The Task Group report was written in the 
format of a Military Standard. The 
Bureau of Ships has already requested 
that this document be made a Military 
Stsndard. I should like to briefly 
discuss this procedure. The document 
assumes that the military will specify 
a level of reliability, most probably 
in terms of Mean-Time-Between-Failure 
and probability level with its comple- 
mentary function, the Maintainability 
Index (Minimum % Up-Time or Maximum % 
Down-Time). The document provides for 
Phase I and II in a development contract. 
Phase I will be a study phase considering 
the entire design in the light of the 
many factors affecting the reliability. 
Figure (1) illustrates these factors. 

The contractor will then propose a 
design and estimste the reliability 
through prediction techniques based on 
perts and tube failure rates and any 
other available techniques specified 

to assess feasibility of meeting the 
reliability requirement. A report is 
submitted which will discuss or show 

the feasibility estimate; the report will 
discuss problem areas and relate planned 
circuit techniques; it will discuss the 
reliability and maintainability require- 
ment relative to performance require- 
ments, weight, space, cost and simpli- 
fication of design. It will recommend 
trade-off considerations. The report 
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will then be evaluated to modify if 
necessary the reliability of any rer- 
formance requirements of the specifi- 
cation; at this time a decision will be 
meade with approval to proceed with 

Phase II, the construction of the 
Prototype Model. As design and 
construction progresses better knowledge 
is available concerning specific parts to 
be used, specific parts environments, 
specific circuits and circuit techniques. 
This enables a closer calculation of the 
estimated reliability with better know- 
ledge of problem areas and the need for 
special part developments, redundancy or 
other solutions. With testing of the 
prototype model, component units and, the 
entire system we again are able to 
reestimate the reliability and perform- 
ance characteristics. Again a report is 
submitted which will include a new 
estimate of the reliability and maintain- 
ability with discussion of performance, 
weight, space, cost and possible simpli- 
fication. With this logical procedure 
the military procurement agency will be 
in a very good position to decide or 
evaluate release to production with a 
fair idee of the level of reliability, 
maintainability and producibility of 

the design. 


As you see, up until now the improve- 
ments called for in specifications were 
in general engineering requirements. 
These were good and must continue. 
However, allied to this, the reliability 
parameter will be specified quantita- 
tively and dealt with in the same manner 
as any other performance characteristic. 


LIMITATIONS AND PROBLEM AREAS 


Let me say this, all is not roses! 
There are ere here for the military 
and for the contractor. Initial cost, 
in the face of curtailed budgets, the 
need to procure perhaps a second or 
third model for test, time for test and 
availability of test facilities will 
plague the military especially for 
equipments with long mean-time-between- 
failures. Limited design guide informa- 
tion in the form of failure rates of 
parts as a function of application 
severities and knowledge of part oper- 
ating environments will present a pro- 
blem to contractors. I should like to 
mention here that presently there are 
two good design guide documents on parts 
failure rates versus application severity 
and environment. These are: The 
recently issued Vitro Report T.R. 98 
resulting from Bureau of Ships Contract 
NObsr-63389 which supersedes in part 
Vitro Report T.R. 80. The other is the 
Radio Corporation of America Report 
TR-1100. RCA has granted permission to 
the Navy Department to reprint this 
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document to permit availability to 
industry. The Office of Technical 
Services, Department of Commerce is 
being asked to reprint TR-1100 and place 
it on sale on non-profit basis, cost of 
printing. 


MAINTAINABILITY 


In the maintainability area I feel 
that much will be done in the next few 
years to place maintainability and its 
contributing elements on a quantitative 
basis or at least in terms of specific 
design criteria for improved maintain- 
ability. In the meantime, it appears 
that this item will be dealt with on a 
design objective basis with general 
design criteria for guidance. 


FREQUENCY COMPATIBILITY 


I should like to close my paper with 
a brief comment on a new specification 
requirement recently introduced. I 
purposely did not mention it prior to 
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discussion of the subject of quantitative 
level of reliability. This requirement 
stems from a reliability problem not in 
terms of time between failures of parts 
or malfunctions but in terms of Frequency 
Compatibility when the equipment is 
installed or operated in the vicinity of 
many other equipments or systems. The 
increasing demand for electronics aboard 
ship, aircraft and at shore installations 
as well as more complex military oper- 
ations electronics-wise has made fre- 
quency compatibility an increasingly 
eritical problem. 


Despite careful planning of frequency 
allocations, congestion in the limited 
spectrum is a problem. Over and above 
this, we now have radars of extremely 
high power output as well as receivers 
of greater sensitivity. These conditions 
are in themselves many times incompatible. 


However, more than that, side lobes 
of transmitting antennas, and spurious 
radiations are disrupting communications, 


guidance systems and detection systems. 
For years we have attempted to attack 
the problem on a reduction of spurious 
radiations basis. Minimum levels of 
interference were established as general 
design guides. However, with the 
increasing amount of electronics required 
in present military operations, it is 
almost impossible to clearly establish 
the radio frequency environment to which 
a design must be aimed. The reduction 
of spurious radiation approach is still 
the basic approach. However, in saddi- 
tion, we must know exactly what the R.F. 
Radiation Characteristics are of an 
equipment (both wanted and unwanted : 

we must know exactly the susceptibility 
or vulnerability of any receiver. With 
this information, a theoretical analysis 
of any installation or task force con- 
figuration can be made at the early 
planning stages. 


Equipment Frequency Spectrum 
Signature. Equipments having undesired 


spectrum characteristics will of neces- 
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sity have to be modified and can be 

prior to release to production. Where 
modification is not possible, other 
corrective actions may be utilized. 

With this problem in mind, the Bureau of 
Ships recently released an amendment to 
the Radio Interference Reduction Speci- 
fication requiring that an "Equipment 
Frequency Spectrum Signature" be obtained 
on all prototype equipments. (Amend - 2 
to Specification MIL-E-16910A and Amend - 
1 to Specification MIL-E-16400B dated 

1 November 1957). 


CONCLUSION 


I have tried to give you a picture 
of the specification area and its role 
or part in the overall reliability effort. 
A brief paper cannot fully exploit this 
area. 


Much has been done but even more 
has to be done. And, here again, the 
words "Industry and Military Cooperation" 
hold more meaning than ever before. 


ACCELERATED LIFE TEST IN AIRFRAME MANUFACTURE 


N. H. Simpson 
Convair-Fort Worth 
A Division of General Dynamics Corporation 
Fort Worth, Texas 


After listening to the various papers on reliabil- 
ity presented so far, I wonder how many of the ’ 
people working in the electronics field have ever 
been associated with the development of an air- 
plane structure. It appears to me that the 
philosophy followed in the engineering, quality 
control, and manufacture of airframe structures is 
of the same type that must go into the development 
of reliable electronic equipment. The structures 
group in the airframe industry is primarily 
responsible for the development and reliability of 
structures. Their responsibilities are as follows: 

1. Make the theoretical calculations required 
' to establish the loads which the structure 
will be required to handle. 


Evaluate existing materials to determine - 
which, if any, may be adequate to do the 
job. This is always accomplished by tests, 
and design allowables are established as a 
result of these tests. 


Evaluate the structural design to determine 
adequacy. Where the design is redundant or 
a new structural principle is involved, . 
tests are always performed to determine 

the design's adequacy. The strength of 

the part is always at least one and one- 
half times that of the design allowable 
under the environment to which it will be 
exposed. 


3. 


Prove to the satisfaction of the company 
and the customer that the strength and 
reliability of the final product is ade- 
quate. This, again, is accomplished by 
tests. 


See that adequate steps are taken to provide 
the necessary means for maintaining quality. 


See that adequate repair procedures are 
developed. They must be such that the 
quality of the structure is not affected.- 
Again, the adequacy of the repair methods 
are established by tests. 


All of us agree that costs are important. 
Now, the cost of development is rising at an 
alarming rate. If sufficient attention is not 
paid to the phasing, organization, and execution 
of development programs, costs will be prohibitive 
in the not-too-distant future. Therefore, it mst 
become as much the responsibility of the engineer 
to keep costs down as it is to develop good equip- 
ment. He can do this, provided he approaches his 
development program in a logical manner. 


Determine whether each small component is ' 
satisfactory for use prior to assembling it into 


_depicts these four phases. 


- tion. 
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the next larger, more complex assembly. Test your. 
subsystems before completing the whole system. Be 
sure that the complete system has an excellent 
chance of working in the environment to which it 
will be exposed. Don't baby it! Make certain 
that your detail designs-are under the surveillance 
of experienced, mature engineers. In the illus- 
trations that follow, I shall show you. the general 
engineering approach and some of the main tests 
involved in designing a reliable airplane struc- 
ture at the Fort Worth Division of Convair. 


In every program there are four phases which 
must be accomplished. Sometimes one or more of 
the phases have already been performed. Figure 1 
Phase one is basic 
research; phase two is applied research; phase 
three is engineering; and phase four is production. 
In the basic research phase, we are seeking an 
understanding of the fundamental laws of nature. 
This type of research should not be directed. At 
the time the work is done, there should be no 
thought of profits or possible use of the informa- 
This work should preceed the applied 
research phase by five to ten years. 


During the applied research phase, we are 
seeking application of the knowledge gained of 
the fundamental laws of nature to the development 
of materials and processes. This phase must be 
directed, and it should at least preceed the 
engineering phase. The engineering phase consists 
of the incorporation of the new materials and 
processes into a suitable design and the develop- 
ment of production methods. The production phase, 
of course, consists of making the article. 


It will be noted that one man in fundamental 
research supports approximately ten men in applied 
research, a thousand men in engineering, and fif- 
teen thousand men in production. It is not diffi- 
cult to see that any time the phases of fundamental 
and applied research overlap those of engineering 
and production, the program is going to be much 
more costly than if each phase is accomplished in 
proper sequence. 


The first thing which should be established 
in any development program is the environment. 
Figure 2 shows the magnitude of the environment 
plotted against time. If one knows the velocity 
and time, one can then determine the acceleration 
to which the equipment will be subjected. Alti- 
tude vs. time gives an indication of the rate at 
which pressure differentials on equipment and 
structure may occur. It will also give an indica- 
tion of the effect of altitude on materials, etc. 
Temperature vs. time is one of the most important 
parameters, since this will give an indication of 
the design allowables which can be used for the 
structural materials. Load on the structure vs. 
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Fig. 1 = Economics of development. 


time, coupled with the temperature curve, deter- 
mines the structural requirements. Noise, load 
reversals, give an idea of the vibration and 
fatigue requirements of the structure. With the 
information shown in Fig. 2 and a knowledge of the 
number of the environmental cycles the structure 
will be required to stand, the engineer can begin 
developing a reliable structure. 


Figure 3 shows the general type of information 
which the structures people require. I believe 
the figure is self-explanatory. In keeping with 
the economics of testing which I previously men- 
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ENVIRONMENT 


tioned, Fig. ) shows the relative cost of testing 
a large number of small components and gradually 
building up into more complex components until the 
final article is built and completely tested. In 
the first part of-the development program on the 
B-58, there were approximately 0,000 small speci- 
mens tested (base line of the chart on the left) . 
to determine the adequacy of adhesive and core. 
Sixty adhesives were screened. Ten of the adhe- 
sives which passed the screening test were given 
a full evaluation test, and three of the ten passed. 
Two of these adhesives were selected, according to 
availability and cost, to be used in the future 
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REQUIRED MECHANICAL PROPERTIES 
ULTIMATE TENSILE STRENGTH 
TENSILE YIELD STRENGTH 
COMPRESSION YIELD STRENGTH 
CREEP AND RUPTURE PROPERTIES 


THERMAL STABILITY 

NOTCH PROPERTIES 

STRAIN RATE PROPERTIES 
BEARING AND SHEAR PROPERTIES 
INSULATION 


Fig. 3 


development of the sandwich panel structure. At 
the top of the cHart on the left, there is only 
one article, the completed airplane. The chart 

on the right depicts a jar of varying diameter. 
This indicates the number of dollars which must be 
thrown into the pot to support the test program 
shown horizontally in the chart on the left. Note 
how rapidly the cost increases when the final 
article is being built and tested. How many final 
articles could you afford to build and test to 
prove your design? 


The screening tests are shown in Fig. 5. 
These tests are selected to eliminate as many 
unsatisfactory materials as possible prior to full- 
evaluation tests. In this way large sums of money 
can be saved. The drawing on the right shows the 
type of test sandwich panel which is produced to 
obtain the test specimens necessary for screening 
tests. This same type of test panel is used in 
the full-evaluation tests. By using a panel of 
this size, it is possible to cut from a single 
panel test specimens for all the various types of 
tests. It tends to minimize the possibility of 


% 


"NUMBER OF SPECIMENS 


DEVELOPMENT SPAN TIME 


obtaining misleading data from any one particular 
test. Also it provides a standardization of pro- 
cedures, so that all evaluation tests are accom- 
plished in the same manner. 


After the materials have passed the screening 
test, they are given the full-evaluation tests which 
are shown in Fig. 6. These tests are more rigor- 
ously run than the screening tests and are more 
complete, as shown by the environments and typical 
tests in the figure. 


Having selected materials which will perform 
satisfactorily in the environment and under the 
load conditions to which the structure will be sub- 
jected, the materials are put together in a typical 
design. Figure 7 shows the elements of a typical 
sandwich panel. This type of structure is chosen 
for several reasons. It permits the use of thin 
metal sheets at high stresses, for all metal is 
effective in bending and is nonbuckling. Because 
the nonbuckling feature is effective in all 
directions, it resists thermobuckling. The panel 
is very fatigue resistant, since it is stiff and 
has a minimum of fasteners. And this panel has 
another property which is interesting to designers 
in that it provides insulation, because the core 
material is made of Fiberglas honeycomb. The 
sandwich panel as shown in the figure is framed 
with aluminum slugs. The Fiberglas honeycomb core 
is placed in between the framing. Aluminum alloy 
facings are bonded to the core and the aluminum 
slugs. All metal-to-metal bonds occurring at 
attachment lines are made with a nitrile rubber 
phenolic adhesive which is fuel tight. All 
facings-to-core bonds are made with an epoxy 
phenolic adhesive. 


To determine the fatigue characteristics of 
the metal-to-metal bond, a fatigue machine such 
as the one shown in Fig. 8 is used. The specimen 
is loaded and then vibrated. The metal-to-metal 
bond is cyclic axial loaded to 600 pounds per 
square inch at a rate of 3,600 cycles per minute. 
This is continued for 10° cycles or continued to 
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COST OF SPECIMENS 


Fig. lh - Economics of test specimen. 
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SCREENING TESTO 


TEM PERATURE 
VIBRATION 

IMPACT AND SHOCK 
TIME 


TENSILE PROPERTIES 
COLUMN COMPRESSION 
COLUMN CREEP 
THERMAL STABILITY 
RESISTANCE TO AIRCRAFT FLUIDS 
WEIGHT 


Fig. 


failure. These tests are run at both low and 
maximum temperatures and room temperature. This 
is accomplished by putting an insulated box around 
the specimen and either cooling or heating as 
required. Figure 9 shows a setup for a simple 
beam test, which provides information on the 
flexural properties of the specimen. Again, these 
tests are run at both high and low temperatures. 


To evaluate the peel strength of the adhesive, 


a test is run which is called the "monkey on a 
string test" (Fig. 10). It employs a drum with 
straps around each end so that, when one face of 
the specimen is attached to the drum and then 
placed in a tensile test machine as indicated in 
the figure and a load is applied, the drum tends 
to rotate. This peels off the one face and the 
drum climbs up the specimen. The load required 
to cause this peeling action to take place is 
called the peel strength. This test is run at 
all temperature extremes and room temperature. 

The peel strength of an adhesive is generally 
much lower at low temperature than it is at room 
or high temperatures. Peel strength is quite sen- 
sitive to improper manufacturing procedures, 
especially with those using contaminated surfaces. 


The small size of the compression test 
specimen shown in the test fixture (Fig. 11) again 
depicts the attempt to save both time and money 
by keeping the specimen sizes as small as possible 
during early testing.’ Again, this test is con- 
ducted at both high and low temperatures and at 
room temperature. 


Before the adhesive and core material can be 
used in sandwich construction, it is necessary to 
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find the effect, if any, of aircraft fluids on 
their physical properties. Figure 12 shows a 
typical setup for the exposure of test specimens 
to aircraft fluids. Each of the glass containers 
is filled with one of the aircraft fluids, such 
as fuel or hydraulic oil. The specimens are 
placed in the container; an insulated cover is 
placed on the fixture; and the temperature is main- 
tained at 10°F. At the end of the first week, 
and each succeeding week thereafter for a total of 
four weeks, eight specimens are removed and tested 
and their physical properties are compared to 
control specimens. During the next eleven months, 
(continued on page 40) 
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“Fig. 13 
(continued from page 36) 


eight specimens are removed each month and tested 
in a similar manner. Thereafter, eight specimens 
are removed each year until a total elapsed time 

'of five years has occurred. All specimens are 
tested in the same manner, both at low and high 


temperatures and at room temperature. 


After the preliminary tests have shown that 
the materials and type of construction appear to 
be satisfactory, larger specimens are made. The 
specimen shown in the test fixture in Fig. 13 is 
3% inch by 21 inches by 23 inches. The test shown 
here is a column compression test. During these 
tests on the sandwich panel construction, the 
adhesive originally chosen was found unsatisfac- 
_ tory in creep property. Therefore, it was neces- 

sary to use the more costly adhesive which had 
. passed the evaluation test and had not been 

Selected because of its availability and higher 

cost. This adhesive proved to be satisfactory. 


The next step is to produce the first full- 
size panels, by production methods. They are 
23 inches by 69 inches by 0.5 inch. The test 
shown in Fig. 1) is called the "Iron Maiden test.* 
The test panel forms one face of an iron box, and 
is so jigged that it is free to move, yet will 
seal so that air pressure can be ‘applied to the 
inside face of the test panel. The specimen and 
jig is then placed in the 600,000 pound test 
machine. The panel is preloaded, brought to the 
necessary temperature and internal pressure, and 
then loaded in compression to failure. During 


some of these tests, the surface exposed to the 
inside of the box is maintained at a temperature 

of -100°F while the external surface is brought 

to maximum temperature at a predetermined rate. 

The external surface is heated with banks of quartz 
Tunsten GE lamps. In some instances ultimate 
design loads @re applied at maximum temperature 

fcr periods of up to 200 hours to determine creep 
properties of the sandwich panel. 


Probably one of the most valuable tests is the 
wing box beam test, shown in Fig. 15. This test 
is designed to represent a portion of the wing. 
For the. first time both bending and. sheer stresses 
are introduced sim taneously into the sandwich 
panel. The entire specimen and jig is placed in 


‘an insulated box haying an insulated lid. The 


ratio of the bending stress to the sheer stress is 
adjusted by use of the four rams shown in the 
illustration. During some of the tests, design 
loads are held on the specimen at maximum tem- 
perature for 200 hours. This gives an indication 
of the amount of creep the structures engineer can 
expect under the same conditions in an airplane. 
In one series of tests, the internal surface is 
held at -100°F, while the external surface is held 
at maximum temperature. In all instances, the test 
is terminated by loading the structure to failure. 


With the advent of high-power jet engines, 
noise became a problem. The horn of an air siren 
and specimen holder is shown in Fig. 16. This 
siren is capable of producing a sound pressure 
level of 170 db. Conventional structure would 
last only a few seconds or minutes in this noise 
level. The sandwich panel type structure is not 
affected over long periods of time; therefore, it 
is being utilized on the B-58. 


The question always arises as to what are the 
long-term weather effects of fuel in contact with 
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Fig. 1h- 
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Fig. 17 


the adhesive and core material. To answer this 
question, Convair makes several specimens which 
are 2), inches by 2h inches by 0.5 inch with a) 
picture-frame integral slug system. The panels 
are internally filled with JP-l; fuel and exposed 
on a jig at a 45 degree angle facing south 

(Fig. 17). One panel is removed annually and 
tested in column creep, simple beam, column com- 
pression, and lap sheer. These tests are con- 
tinued over several years. 


In order for the structures people to evalu- 
ate their theories and substantiate their calcu- 
lations of a redundant structure, they must build 
an elastic model. The elastic model is similar 
in nature to the bread board of the electronics 
engineer. From this model, which is very complete 
as far as geometry is concerned, the structures 
engineer determines the elastic constant of the 
structure and the distribution of loads under 
various loading conditions. The load distribu- 
tion, Fig. 18, is determined by approximately 


2,400 strain gages throughout the model. The 
model is placed in the jig upside down, so that 
loads can be applied using calibrated lead weights 
supported on hangers. The results obtained from 
the elastic model are compared to other struc- 
trual tests on components and ultimately to those 
obtained from the final static test airplane. 


Since the sandwich panel is going to be used 
to form the sides of an integral fuel tank, it is 
necessary to evaluate it for this purpose. 

Figure 19 shows a portion of a wing fuel tank, 
which is placed in an insulated box so that the 
temperature can be controlled. It is jigged so 
that various loads can be applied which simulate 
the worst loading conditions expected on the air- 
craft. These loads are cycled the same number 
of times they are expected to occur during the 
life of the airplane. 


Figure 20 is a test designed to evaluate the 
wing tank to determine its ability to handle 
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Fig. 21 


inertial loading due to the movement of the fuel. 
The effect of vibration is also determined and 
this is also a life endurance test. 


It is of little use to develop new types of 
structures unless simultaneously with their devel- 
opment the necessary tools for controlling the 
quality of the structure are developed. Very 
early in the program, Convair’ began looking for a 
satisfactory method of evaluating the soundness 
of an adhesive bond, both metal-to-metal and metal- 
to-core. Several ideas were tried. One particular 
idea obtained from Stanford Research Institute, 
from work done under an Air Force contract, proved 
most successful. This idea was taken and devel- _ 
oped, and it materialized as a suitable production 
testing device. Figure.21 shows an inspector 
using this device. It is an ultrasonic impedance 
tester which consists of a power source for deriv 
ing a piezoelectrical crystal at one of its 
natural frequencies and a suitable detector for 
measuring impedance changes. The piezoelectrical 
crystal is coupled to the surface of the specimen 
being tested with oil. The detection circuit 
shows any variance of impedance from a standard 
panel. 


The most difficult task confronting the - 
engineer on this project is interpretation of 
data presented by the instrument. Finally, it is 
found that there is no problem if the instrument 


is used as a comparator and calibrated with 
standard panels having known defects. Figure 22 
shows a typical signal indicating a complete void 
on a sandwich panel. If it were a good bond, the 
display would be a very narrow wavy line on the 
center of the oscilloscope. . The display changes 


. gradually into the shape shown in the illustra- 


tion as the bond deteriorates and approaches that 
of a void. This device is only one of many 
quality control procedures used in manufacturing 
the sandwich panel. 


Figure 23 shows the slugs of a large wing 
panel. Some of the wing panels have as mich as 
90 square feet per side.’ A wing panel being laid 
up is shown in Fig. 24. The core has already been 
inserted between the slug frames. Note the white 
gloves. It is necessary that surgical cleanliness 
be maintained throughout portions of this work. 


Bonding presses are rather large. Figure 25 
shows a bonding press which is closed. The panel 
being bonded has been, placed between the steam- 
heated platens. The pressure applied to the panel 
is 150 pounds per square inch; the temperature is 
350°F; and the time is 2 hours. Close tolerances 
must be held on all parts and the platen. 


In order to get an idea of the extent of 
bonded sandwich panel, metal-to-metal bonding, 
and brazed sandwich panel, a breakdown of their 


use is shown in Fig. 26.- From this it is easy to 
see why the B-58 is sometimes referred to as the 
completely bonded airplane. 


Prior to the flight of the first airplane, 
the critical sections are proof-tested. Figure 27 
shows a typical proof -test of the tail section of 
the B-58. During proof tests, loads are applied 
to 100 per cent of the design limit. 


No doubt, all of you saw pictures in the press 
of the static test B-58 being carried by a B-36 
to Wright Field for the final structural tests 
of the complete airplane. The airplane as it 
looked after being transported to Wright Field is 
shown in Fig. 28. The tail, control surfaces, 


nacelles, and landing gear were transported 
separately and assembled on the airplane at Wright 
Field. The airplane is being tested under speci- 
fied load and environment conditions to failure. 


As a result of all the testing that has gone 
on in the development of the structure for the 
B-58, we arrive at the final aircraft showm in 
Fig. 29. To date, flight tests of fourteen 
months indicate that as far as the structure is 
concerned, the B-58 was tactical the day it 
rolled off the final assembly line. It is hoped, 
for the sake of our country's economy and secu- 
rity, that the equipment manufacturers will soon 
have their development programs organized to 
achieve the same goal. 
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SYSTEM ASPECTS 
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Tall 


Missile and Surface Radar Engineering 
Radio Corporation of America 
Moorestown, New Jersey 


An effective reliability program is concerned with 
two major areas of effort. These might be termed 
reliability assurance and reliability improvement. 
The assurance area is concerned with the steps one 
takes prior to "releases" the improvement area, 
with revealing and correcting reliability defi- 
ciencies subsequent to "release." As a dividing 
line the "release point" depends upon the activity 
considered. The dividing line selected is not 
pertinent to our discussion, nor is the fact that 
both areas may be carried on concurrently. What 
is important is the recognition that the assurance 
area represents the most economical effort in a 
reliability program and is worthy of renewed 
emphasis. 


This discussion is concerned with an aspect 
of our reliability assurance program which has be- 
come an important management tool in directing re- 
liability effort in an effective and economical 
manner, We call this effort the system effective- 
ness approach to reliability. In this approach we 
are concerned with the end result of reliability 
or lack of reliability; we are concerned with the 
effect of a failure on over-all system performance. 


When we are dealing with a large weapon sys- 
tem which may be a multifunction and multichannel 
system, the normal measures of reliability lose 
their meaning. The normal measures, such as mean- 
time~between-failures, failure rate, and probabil- 
ity of failure-free operation, are primarily con- 
cerned with failure frequency. An additional 
dimension, such as failure severity, must be added. 


Failure severity is a measure of the effect 
of a failure on system performance, and most im- 
portantly, the duration of this effect, i.e., 
down-time. Theory tells us we cannot reduce the 
probability of failure to zero. Thus it behooves 
us not only to reduce this probability to as low a 
value as possible but also to concern ourselves 
with the types of failure we can expect, the ef- 
fect on system capability, and the time to detect, 
isolate, and correct the failure. 


Since these factors are controllable to a 
large extent in design, their consideration be- 
comes an integral part of our reliability assur- 
ance program. In addition, large weapon systems 
are generally custom-built rather than mass- 
produced. When relatively few systems are being 
constructed, we cannot set aside several for rig- 
orous test, nor can we depend heavily on adequate 
field experience becoming available early in the 
production cycle. As a result, we must depend to 
a greater degree on our assurance techniques in 
order to achieve the desired.degree of reliability 


As an illustration of the system effective- 
ness approach to achieving reliability, let's as- 


sume a simple missile fire-control system. The 
basic elements of this system are a radar, comput- 
er, and launcher. In operation the radar will be 
employed 100 per cent of the time; the computer, 
SO per cent of the times; and the launcher, 25 per 
cent of the time. The best system plan has been 
selected in terms of system capacity and efficien— 
cy.* For purposes of illustration, a )-2-1 system 
has been selected, as shown in Fig. 1 (that is, 
four radars, two computers, and one launcher). 
Thus, both computer and launcher idle time are re- 
duced, and the capacity of the system has been 
multiplied four-fold. 


A contractor's experience, particularly his 
documented experience, plays an important role 
from this point on. The technique requires that 
certain estimates or predictions be made. These 
estimates are based on contractor experience with 
his own designs as opposed to the generalized ex- 
perience of all contractors’ equipment. Of course 
some estimates may be gross in nature. This is an 
indication of how well prior experience has been 
documented. The further along a development pro- 
gresses, the more sophisticated are the prediction 
techniques that may be employed. However, the 
value of the system effectiveness approach in the 
earliest development phases overrides the effect 
of gross estimates. 


In our example we are given three basic func- 
tional types of equipment -- radar, computer, and 
launcher. Based on our prior experience and on 
the current state of the art, we can estimate the 
mean-time-between-failures and the mean down-time 
that we can achieve. At this point in the devel- 
opment, we are only concerned with the order of 
magnitude of the number of parts involved. Our 
reliability estimate for each equipment is ini- 
tially based on what may be called the contrac- 
tor's standard level of excellence. 


Let me digress’ a moment and discuss the con- 
tractor's standard level of excellence. The cost 
of development of an equipment has been considered 
as increasing, some say exponentially, as a func- 
tion of reliability achievement. It is not gener- 
ally recognized that there is an area of reliabil- 
ity achievement where an applied reliability 
effort actually reduces development costs. This 
reduction may be attributed to the introduction of 
a design control function which reduces the number 
of repetitive errors in design, exerts a standard- 
izing influence on part selection, and so on. In 
a sense, the engineering operation is made more 


“Tall, M. M., and Sherman, S. M.: "Reliable Sys- 
tem Design." Presented at the Second RETMA Sym- 
posium on Applied Reliability, Syracuse, New 
York, June 10 and 11, 1957. 
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efficient by the injection of documented reliabil- 
ity experience, 


In Fig. 2 contractor development costs are 
shown qualitatively as a function of reliability. 
The minimum point which results from normal reli- 
ability controls represents the contractor's 
standard. This is the level a contractor seeks 
to achieve in the absence of specific quantitative 
reliability requirements. I do not intend to in- 
fer that this level may not be more than adequate 
for the equipment function. It does point out 
that our present procurement procedures which are 
based on price and delivery compel a contractor to 
build at this level. 


For comparison purposes, the service support 
and over-all costs are shown. The service stand- 
ard represents the minimum cost if a few systems 
are constructed, and moves to the right as the 
number produced increases. As has been said many 
times in the past, it behooves the services to pay 
higher initial development costs to achieve better 
reliability. 


The service standard may be considered to be 
the specified level of reliability in the absence 
,of rigorous reliability requirements. In regard 
to contractor development costs, it should be 
pointed out that the minimum point varies both 
vertically and horizontally, depending on the type 
of equipment involved and a contractor's experi- 
ence with that equipment. In our estimate for 
each of the equipment types in our system, we take 
the contractor standard as a starting point. 


With an estimate for each type of equipment 
in our system, we must define what we mean by sys- 


51 


tem effectiveness for our particular system. In 
each case system effectiveness should be a measure 
of the output function of the system.in its appli- 
cation. In our example we are concerned with a 
missile fire-control system. The output function 
is to guide a missile to a target. In addition 
it shall perform this function at some determined 
rate, that is, with a given system capacity or 
firepower. A good measure for this system might 
be relative firepower, the ratio of the actual 

or predicted firepower to the firepower that would 
result with 100 per cent reliability. Since we 
are. concerned only with the fire-control system, 
we assume a missile reliability of 100 per cent. 


If the missile is included in the system, a 
useful measure may be relative kill probability or 
kill probability, depending on one's point of 
view. In the first instance, we separate the in- 
herent. accuracy of the system from its reliability 
by accepting the fact that a 100 per cent reliable 
system has a kill probability of less than one. 

In this case the measure is the actual or predic- 
ted kills to the probable number of kills with 
100 per cent reliability. On the other hand, we 
can assume that a 100 per cent reliable system has 
a kill probability of one, and the measure, kill 
probability, then includes both the factors of 
system reliability and accuracy. 


It should be mentioned that this concept of 
measuring output in its application may be applied 
to subsystems, chassis, and even parts. We are 
all familiar with applications that can accept a 
part variation of 50 per cent or more and other 
applications where a part variation of 10 per cent 
or less would be considered a failure. The meas- 
ure should reflect the real application require- 
ment rather than an arbitrary one. 


COST 


With a definition of system effectiveness as 
relative firepower for our system, let us employ 
some illustrative numbers for the determination. 
Assume that the contractor standard for the radar 
yields a mean-time-between-failure which we will 
call T of 57 hours, and a mean down-time which we 
will call D of 3 hours. The computer has a T of 
98 hours and a D of 2 hours; the launcher has a T 
of 990 hours and a D of 10 hours. Since our sys- 
tem should have an operational capability of 2h 
hours per day, we are concerned with the availa- 
bility of each equipment or the probability that 
the equipment will be available at any given in- 
stant. Availability may be expressed as A = T/T+4D 
the mean-operating-time-between-failures divided 
by the sum of the mean-operating-time-between- 
failures and the mean down-time. Table I shows 
the availability for the various equipments. 


Our particular system, a 4-2-1 system, will 
have a capacity or firepower of for each cycle 
of operation. If this represents the firepower 
with 100 per cent reliability, failures will re- 
duce the firepower to 3, 2, 1, or O depending upon 
the severity of the failures. In our system mod- 
el, only integral values are possible. Our de- 
termination of relative firepower requires that 
we compute for what fraction of time each level of 
firepower exists and their wieghted average. 

Table II indicates the process we employ. The 
first column shows all combinations of operable 
and inoperable equipments. Thus, l}-2-1 means all 
the equipments are operable. The first number has 
five possible values (, 3, 2, 1, and 0); the sec- 
ond has three (2, 1, and 0); and the third has two 
(1 and 0). Therefore, there are 30 possible com~ 
binations. However, it is not necessary to list 
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them separately, since those with zero firepower 
can be conveniently grouped together. 


The firepower for this simple system may be 
obtained by examining the system configuration and 
noting which unit is limiting for each combina- 
tion. The formulas represent, in terms of unit 
availabilities, the fraction of the time that each 
combination will exist. It is helpful to think of 
the availabilities as probabilities. Note that on 
a 2h-hour-per-day schedule, the system will be 
fully operable 77.) per cent of the time and com- 
pletely inoperable only 1 per cent of the time. 
This, of course, is due to the redundancy in the 
system. 


We call the type of redundancy employed func- 
tional redundancy, as opposed to spare redundancy. 
Functional redundancy is equipment duplication 
which contributes to the system capacity as well 


TABLE I 


Equipment Availability 


Frese 

T+D 
Radar: T= 57, D= 3 dg * pele ree 
Computer: om og H's 2 Long = .98 
Launcher: T = 990, D = 10 Ay? = mn = 99 


TABLE IT 


Relative Firepower Computations 


Combination Firepower 

y-2=1 h 
3-2-1 3 
2-2-1 2 
1-2-1 uk 
0-2-1 fe) 
4-1-1 2 
3-1-1 2 
2-1-1 2 
1-1-1 1 
0-1-1 fe) 
M=-0-1 ) 

(5 cases: M=4,3,2,1,0) 
M-N-O (0) 

(15 cases: M=4,3,2,1,0 

and N=2,1,0) 


Formula Availability 

ApUac 2ar, 77 
Ap? (1-Ap )AG2Ar, 2163 
6Ap?(1-Ap)2AG2Az, 2013 
LAR ( 1-Ap) 3A 2Ar, 2000 
(1-AR) 4ag2ay, .000 
Agu2Ag(1-Ac) Ay, .032 
hAp3 (1-Ap) 2Ag (1-Ag ) Ar, 2007 
6An?(1-Ap)?2A (1-Ac ) Ay, 2001 
Ap (1-Ap)32A¢(1-Ag) Ay, .000 
(1-Ap) 4246 (1-Ac) Ay, .000 
(1-A¢) Ay, .000 
1A, 010 

1.000 


as to reliability. Spare redundancy is duplica- 
tion which does not increase system capacity but 
is intended only to improve reliability. The 
economy of functional redundancy achieved by mul- 
tiplexing or time-sharing equipments leads us to 
seek this type of solution for improved reliabil- 
ity wherever possible. 


Since several combinations yield the same 
firepower, we group them together in Table III. 
The average firepower is obtained by multiplying 
each possible firepower condition by its probable 
occurrence and summing the products as shown. 
Relative firepower is the ratio in per cent of the 
average firepower to the firepower that would be 
obtained with 100 per cent reliability, in this 
case. 


A relative firepower of 92 per cent is the 
value we would attempt to deliver in the absence 
of a specific quantitative reliability require- 
ment. This firepower results from designing 
equipment to the contractor's standard level of 
excellence. If this value is satisfactory or 
meets a specified reliability requirement, our 
task becomes one of monitoring to insure the main- 
tenance of the contractor's standard, In the 
event a reliability requirement beyond this value 
is specified, our next step is to determine the 
most economical solution for the requirement. 
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This step might be termed the "system sensi- 
tivity" phase of the analysis. This phase simply 
involves the determination of the effect on rela- 
tive firepower of equal proportional improvements 
in the availability of each equipment type. Table 
IV shows the results of substituting improved val- 
ues of Ap, An, and Ay, one at a time. An incre- 
mental improvement of 1 per cent was applied to 
each of the availabilities. The important part of 
this table is the value of the ratio of the per 
cent improvement in average firepower to the per 
cent. improvement in availability. The results 
are not particularly surprising in this simple 
system, although they may prove to be so in some 
of our more complex systems. 


TABLE ITI 


Relative Firepower 


Firepower Probability FP X P 
h 0774 3.096 
3 163 2489 
2 053 106 
1 .000 .000 
0 2010 «000 
1.000 3.691 
Average firepower: 3.691 
Relative firepower: 92% 


TABLE IV 


System Sensitivity 


Incremental improvement: 1% 

Orig. Improvement 1 Improvement 2 Improvement 3 
Apo 095 950 Aspe 950 
Ac- 98 980 980 989% 
Ar- 099 3999" °990 0990 
Average firepower 3.691 Smries Boreas 3.722 
Relative firepower (%) 92 93 93 93 
Av. firepower improvement - 1.00 0.87 0.84 


Availability improvement 


*Improved value of availability. 


The next step in the analysis involves esti- 
mating the cost of achieving these improvements in 
availability. For the sake of simplicity, let us 
assume a unit cost for the radar, 1.5 times the 
unit cost for the computer and 2 times the unit 
cost for the launcher. It should be recognized 
that cost estimates for the first incremental im- 
provement do not necessarily hold for a second or 
larger incremental improvement, although their 
relative order may remdin the same. 


In Table V we see that the radar with the 
greatest room for improvement yields an improve- 
ment of 0.87 per unit cost, whereas the launcher 
which affects the average firepower most directly 
yields an improvement of only 0.50 per unit cost. 
Several additional increments can be estimated in 


TABLE V 


Improvement Costs 


FP Impr. Cost of Impr./ 
Avail. Impr. Impr. Unit Cost 
Radar 0.87 ik 0.87 
Computer 0.84 1.5 0.56 
Launcher 1,00 2 0.50 
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a like manner. The combination yielding the de- 
sired level of reliability at minimum cost is 
selected. 


Inherent in these cost estimates is the sys- 
tem's application. Remember that availability is 
equal to the mean-operating-time-between-failures, 
T, divided by the sum of the mean-operating-time- 
between-failures and the mean down-time, D. An 
improvement in availability may be achieved by in- 
creasing T, decreasing D, or both. In a system 
having a 2 hour capability requirement, we can 
tolerate an increase in the failure rate (decrease 
in T) if we can substantially reduce the mean 
down-time. On the other hand, some applications 
may require a high probability of failure-free op- 
eration (increase in T) for some period of time 
regardless of the down-time which may occur as a 
result of failure. This situation may occur in a 
device which we do not intend to repair. Other 
situations may be compromises where we may desire 
to perform maintenance at convenient intervals. 


Since the decisions resulting from this anal- 
ysis were based on engineering judgements and es- 
timates, some of which may be gross, the analysis 
is kept current as work progresses. It continues 
to serve in guiding the system development toward 
the achievement of the required reliability at the . 
minimum investment. 


RELIABLE SYSTEM DESIGN BY PART ENGINEERING 


C. G. Walance 
Hughes Aircraft Company 
Culver City, California 


This paper will concern itself with the or- 
ganization and activity of a component application 
engineering organization and the part it plays in 
the development of electronic systems with parti- 
cular emphasis on those aspects which influence 
the reliability of the system. 


The reliability of electronic systems is a 
function of, among other things, certain charac- 
teristics of the component parts and the manner 
and extent to which those characteristics are 
stressed in the system application. It is there- 
fore imperative that those designing electronic 
systems have readily available to them informatim 
concerning’ the characteristics of component parts 
including the correlation between application . 
stress and failure rate. The determination of 
_ these factors is a task for experts in the field 
and not for standards engineers or abstractors of 
catalogues. In addition, it is true that a high 
percentage of component development and modifi- 
cation is financed by electronic system develop- 
ment funds. The establishment of new component 
requirements and the transmittal of those require- 
ments to those doins component development should 
be left neither to standards engineers nor’ to the 
equipment designers, since each is a specialist 
in a different field. For these and other rea- 
sons, it is our opinion that an electronic equip- 
ment development organization can no more do with 
out a component engineering capability than an 
equipment manufacturer can do without a quality 
control orsanization. The size and nature of 
this component engineering capability is, of 
course, a function of the size, organization, and 
nature of work of the particular equipment devel- 
opment activity. This component engineering 
capability may vary from one senior engineer en- 
compassing all electronic parts to a large com- 
prehensive organization such as exists at Hughes 
Aircraft Company, having a number of senior 
specialists in each component field, such as 
transformers, resistors, capacitors, relays, 
semiconductors, etc. 


Regardless of the size of the component engi- 
neering activity or the organizational context in 
which it finds itself, to be really successful, 
there are certain requirements which must be sat- 
isfied. Without these, a highly successful pro- 
gram is not possible. 


é The personnel must be of high profession- 
al calibre. Without this, what follows cannot be 
done, and program is doomed to failure. Design 
engineers tend to express their requirements in 
terms of circuit parameters, whereas the compo- 
nents incustry in general tends to express compo- 
nent capabilities in component terms, The compo- 
nent application engineer must have the ability 
to communicate with both the design engineers and 
with people in the component industry in their 


1. 
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own respective languages. Experienced personnel 
of this sort are exceedingly difficult to come by 
and must generallv be trained on the job. 


2. The organizational structure must be such 
that the components engineers are able to work 
freely and closely with the design engineers at 
the working level. Certain equipment manufactur- 
ers have made the mistake of assembling a group of 
competent experts at a high staff level, which 
makes a close relationship with the working-level 
design engineers exceedingly difficult. 


3. The components engineering organization 
must have the responsibility of preparing pre- 
ferred parts lists and application criteria, and 
must be permitted to exercise control over compo= 
nents application. Obviously, since the components 
organization has no direct design responsibility, 
it cannot have final design authority. If it is. 
to be overruled, however, such overruling-should 
come from the project management rather than the 
design engineering level. 


h. The components organization must have 
management support. Top management support is 
particularly important in the case of any service 
organization such as this, Management must see to 
it that the organization is properly equipped with 
personnel, laboratory facilities, and funds, In 
addition, it mst be clearly extablished in their 
charter of operations that they are the contact 
point in engineering on all matters pertaining to 
component parts. This implies that field and fac- 
tory problems on component parts are referred to 
this organization, 


5. The authority mst rest with the compo- 
nents engineering organization to approve compo- 
nent sources of supply for the company. It should 
not be left to the discretion of purchasing or any 
other organization to assure itself that one ven=- 
dor's product is the equivalent of another. This 
is an engineering function and must be done by the. 
component engineering organization. In addition 
to the other advantages accruing from a procedure 
of this sort, it gives the component engineering 
organization a large lever in operating with com- 
ponent vendors, A component supplier is much more 
likely to cooperate in the development of a compo- 
nent with an organization if that organization is 
also the one which has the authority to approve or 
disapprove the sources of supply. 


6, The component organization mst, in addi- 
tion to the above, have responsibility for the 
whole component envineering function, including 
the preparation of specifications and standards 
and the evaluation of comoonents, Obviously, only 
the design engineers can determine component char= 
acteristic requiremnts, but the selection of the 
exact part and the source of supply shovld rest 
with the component engineering orsanization. 


7. A portion of the effort of the component 
engineering activity shonld operate on a contin- 
uous basis and not be tied to specific projects or 
problems, Onlv in this wav may advanced work pro- 
ceed and mav the design activity be assured of pre 
per components being available when required. 


One may speak of a reliability engineering 
program onlv during the development phase of the 
system, Once a design is firm and released to 
production, one is no longer working on reliabil- 
ity but on unreliability. The problem is no long- 
er one of desiepning reliability into the system 
but of removing unreliability from it. The func- 
tion of the component engineering activity during 
the development time of a system may be divided 
into two aspects, that involving the work with the 
design engineers and that involving vendors, The 
design enzineers need to be furnished with lists 
of preferred and proven parts, application notes, 
and a consulting engineering service. Component 
application engineers should sit on design review 
boards and, in general, work closely with the de-=- 
sien engineer. On the other hand, the component 
engineers need to begin communicating with poten= 
tial sources of supply. Requirements for new com- 
ponents need to be transmitted to the vendors by 
means of definitive specifications, It is our 
feeling that the importance of specifications has 
been overemphasized in that the concept is fre= 
quently overlooked, that during the development 
program they serve merely as means of commni- 
cation. The components manufacturer needs to be 
told clearly and completely the requirements for 
new components, preferably in his own language. 
The choice of a proper supplier is all-important, 
since it is our feeling that a supplier who lacks 
either competence or integrity cannot be depended 
upon to furnish reliable components no matter how 
stringent the specification, or how rigorous the 
quality control procedures may be. Samples of the 
components should be obtained and evaluation tests 
conducted. Again, we feel that the importance of 
qualification tests has in the past been over- 
emphasized. The levels of reliability currently 
required are such that very little useful infor- 
mation may be gained in that regard by the running 
of a few tests on a comparatively small number of 
samples. Rather, it is felt that tests should be 
conducted which will give a component expert in- 
formation pertaining to the adequacy of the ven- 
dor's design, and that approval or disapproval of 
the component and of the supplier should be based 
upon a total consideration of the component and 
the vendor's capability, rather than go, no-go 
tests of a qualification nature, 


A different sort of task is that associated 
with removing unreliability from an existing sys- 
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tem, The work here starts with analyzing failures 
during design environmental tests and continues on 
a larger scale during the production of the system, 
System reliability testing as a normal production 
test, usually on a sampling basis, has been under= 
way at Hughes Aircraft Company for a number of 
years, The trend of mean time to failure in these 
tests is watched closely, particularly with regard 
to those component failures chiefly responsible 
for determining the mean time to failure. After 

a system is in the field, rapid accurate and com- 
plete failure feedback information is essential. 


Once major unreliability problems are isolated, 
there is no substitute for the prompt return of 
failed components together with the components! 
histories. The component part should then be care- 
fully analyzed in the light of its history and 
application. This may be done by the component 
engineer or preferably, where possible, the part, 
its history, and application information should be 
returned to the vendor. At the Hughes Aircraft 
Company such a feedback program has been underway 
for several years with very satisfactory results. 


It is my opinion, based on examination of 
unreliability problems encountered in many differ- 
ent types of equipment, that too much has been 
said about the statistics of the problems, about 
the interpretation of the statistics, and not 
enough about the underlying causes of the problems, 
In particular I make reference to the fact that 
the whole field of reliability has become shrouded 
with an aura of probabilities, statistics, moun- 
tains of data, and theory. Much of this is neces- 
sary and proper. Some of it, however, has tended 
to hide the fact that a very high percentage of 
the reliability problems with us today are simply 
the result of poor engineering, and that a careful 
examination of a relatively small sample of failed 
components will reveal poor component design or 
fabrication techniques, or gross misapplication. 
If we are requiring reliability levels ten times 
higher than those presently obtained, then new 
techniques are required, and very subtle charac-= 
teristics of components and their application be- 
come all-important, I sincerely believe that an 
honest appraisal of most present reliability prob= 
lems will result in the conclusion that there have 
been design and manufacturing errors which would 
have been easily correctable if detected, during 
the time the equipment was being designed or fab- 
ricated, 


The proper use of a comparatively small 
number of component and reliability engineers at 
this early stage will have a much greater effect 
on the ultimate reliability of the system than any 
other means presently at our disposal, 


_ 


THE CHALLENGE OF RELIABILITY TO MANAGEMENT 


William W. Wooldridge 
Hughes Aircraft Company 
Culver City, California 


The period since World War II has presented many 
challenges to industrial management. The skill, 
imagination, and determination used in facing 
these challenges has made the difference between 
Success and failure. 


In the last few years, product reliability 
has climbed to a prominent position among the 
issues requiring management attention. It is 
related to other vital issues characteristic of 
these times. For example: technical progress has 
been accelerating; there is great pressure to 
reduce the time required for new developments; the 
upward spiral of costs causes problems. It is 
management's job to fit product reliability into 
its proper place, and to determine what program of 
action will bring results. 


But certain points are indisputable. We are 
bound by our formula of national defense to work 
on the basis that there can be no excuse for prod- 
uct failure. Indeed, we cannot expect to have the 
time to make an excuse for failure. The weapons 
and weapon systems we employ mst work precisely 
as they are intended to work. They must do the 
job of keeping an enemy off our heads, and they 
must do it on an instant's notice, thoroughly and 
efficiently and with no margin for error. One 
error, in the age of the H-bomb, means certain 
disaster. We must make sure that such an error 
cannot possibly be permitted by the failure of 
some electronic or mechanical device, small or 
large, simple or complex. 


Another consideration is how we look to the 
rest of the world -- call this prestige, face, 
reputation, or what you will. Second place at the 
diplomatic bargaining table is no better than 
second place in nuclear warfare. As a nation, we 
must retain our proper position as the leader of 
the nations that do things. Our accomplishments 
must speak for themselves -= not on paper, not in 
conversation, not in the rosy plans for the future. 
We must be known as the nation whose weapons are 
to be respected, so that no one will dare to try 
us out for size. 


This does not mean that we should rush to the 
launching pads before we are ready. But whatever 
we do undertake, say the firing of an ICBM or the 
shooting down of a defenseless drone in routine 
practice, must come off as scheduled. That is not 
an original thought, but it is one we mst keep in 
mind as we design, develop, and produce. 


Every little movement will have to go accord- 
ing to plan. And that means reliability with a 
great big "R." This brings us back to the problem 
of industrial management. These technical, sched- 
ule, and cost issues have many interactions with 
the question of reliability. There is ample evi- 
dence that a product will be most dependable when 
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it has been thoroughly de-bugged, when design has 
been stabilized, and when a steady flow of produc- 
tion is coming from hard tooling. 


The increasing pace of technical advancement 
upsets this approach. A parts manufacturer whose 
design is static for as much as three years will 
find his markets disappearing. A missile that 
waits for the completion of every conceivable test 
before entering production will be obsolete before 
it is available. Management, both industrial and 
military, has had to balance the risk of coming 
too late against the risk of trouble with the 
product. 


The rapid pace of development has other 
effects that are particularly noticeable in mili- 
tary electronics. It has turned out that there 
are an increasing number of military tasks that 
can be accomplished only through the use of elec- 
tronic equipment. While there have been strenuous 
efforts to simplify designs, any benefits are off- 
set by the increasing list of jobs to be done. 

One result of this trend to complex equipment has 
been the extraordinary demand for uniformity and 
dependability on the multitude of circuit parts. 
In addition, the new tasks have thrust electronics 
into unfriendly environments. Designers face an 
ascending scale of stresses to the point where the 
raw materials themselves lack the strength to 
survive. 


' This reach for technical advancement has had 
a serious effect on equipment costs. We must add 
the steady upward trend of the cost of labor and 
materials. The manager of commercial enterprise 
must worry about shrinking markets, and in the 
military field the burden on government budgets is 
well-known. 


An attempt to achieve reliability without 
regard for cost is as impractical as disregarding 
development time schedules. For example, the 
effort to increase reliability has led to added 
tests on system and major assemblies and on the 
thousands of detail parts. Any attempt to develop 
this approach to its logical extreme would soon 
consume all of a manufacturer's floor space, 
equipment, and operating man-hours. 


So the question of equipment reliability must 
compete for management's attention against the 
issues of schedule, performance, and cost. The 
competition has been unequal in one respect; that 
is, the other issues have quantitative goals, and 
success in meeting them can.be measured. New 
equipment must be delivered by a certain date, and 
its range, gain, or sensitivity mst achieve meas- 
urable advances. Failure to meet these goals 
threatens the company's business future, and fail- 
ure to keep costs within the funds available is 


equally damaging. 


Reliability, on the other hand, has not had a 
quantitative goal. It has not been measurable 
until equipment was produced and in use. That 
managements have concentrated their attention on 
the requirements that could be measured should not 
be surprising. This weakness hag been recognized. 
The Department of Defense, the military services, 
and the more enterprising industrial managements 
have been tackling the question. It is not too 
difficult to decide that, under a given set of 
circumstances, equipment should work 90 per cent 
or 99 per cent of the time. But this step raises 
more questions than it settles. 


When and how is compliance to be demonstrated? 
Can a prediction be made from the drawing board? 
It has been shown that improved design techniques 
can achieve a ten-to-one reduction in failure fre- 
quency between one model of equipment and the next. 
Can a high order of reliability be demonstrated 
with reasonable accuracy by tests on a small quan-e 
tity of laboratory models? Will tests run in the 
factory before delivery correlate with results in 
service use? 


We have only the beginnings of answers to 
these questions. A prudent management will take a 
hard look at the degree of business risk involved 
in reliability specifications. There is the very 
real danger that too much money and manpower will 
be tied up in demonstrations, to the detriment of 
the real job of improving the equipment. With 
experience, it should be possible to include relia. 
bility among the other factors that management has 
learned to measure and control. 


That quality and dependable performance mst 
be built into a product is a frequently repeated 
truism. It is equally true that reliability is 
everybody's job from the janitor who cleans a 
work bench to the general manager who decides 
whether or not to invest in a new test facility. 
Something that is everybody's job is always in 
danger of being taken for granted; the wheel gets 
grease only when its squeaking cannot be ignored. 
It is a principle c:,/modern management to set up 
agencies whose job 7s to assure that the company's 
objectives are being fulfilled. There is an 
aAncreasing tendency to handle reliability in this 
manner. 


If we are to achieve the decided advances 
that are necessary, the old ways of doing things 
will not always be good enough. New approaches 
are needed to design development, and more effec-— 
tive test methods are required. The process of 
uncovering the cause of failures and of incorpor 
rating improvements mst be speeded up. The. 
effort mst reach across every activity of the 
company. There are undoubtedly many acceptable 
organizational approaches, but management needs a 
function that can help to establish policy, pro- 
mote new approaches, and report major questions 
for action. The reliability job is not one that 
can be done by business management alone. A num- 
ber of specific problems need joint action by the 
industry-military team. Some realistic thinking 
is essential on the trade-off between performance 
and reliability. 


‘tasks we are attempting. 


Electronics has been able to perform so many 
fascinating tricks that we have sometimes forgotten 
to count the cost of added features. There is no 
escaping the fact that each added "black box" 
inevitably adds opportunities for failure. We have 
also been forgetting to pay the piper on another 
score. We establish the need for a formidable new 
system, and then start looking around for the parts 
to put it together. It has been very difficult to 
get money for research leading to parts development 
until a definite equipment application is in sight. 
This is too late. : 


The systems designer must decide whether to 
use proven but less than adequate parts or to throw 
his hat at developments that are still on the hori- 
zon. Some unhappy results have come from following 
the latter course. No one company or project car- 
ries enough weight to move the parts-manufac turing 
industry toward the broad advances demanded by the 
An expanded research pro- 
gram is needed, if we are. to develop tne bits and 
pieces for tomorrow's equipment. 


In another area the equipment manufacturer is 
at the marcy of factors beyond his control. Data 
from service operations shows that the results 
achieved are many times more variable than can be 
accounted for by differences in the equipment 
itself. When the reasons are investiagted, we find 
that there are blocks in the spares supply line, 
that test equipment is not available’ to support 
maintenance operations, and that techniciams lack 
training and experience. It is industry's job to 
relieve this problem by reducing the need for 
excessive maintenance, and by making field check- 
out easier to handle. - 


But the human factor will not be eliminated 
tomorrow. This technical age requires an éver 
increasing body of skilled personnel. Education, 
industry, and the military mst tackle the problem 
of increasing this essential resource. 


Finally, no program to improve the dependa- 
bility of equipment is going to get very far until 
we provide for the fact that reliability costs 
money. There is an initial investment that mst 
be made before we realize the pay-off. A manage- 
ment is willing to buy an.-expensive new machine 
tool because it will soon pay for-itself in 
reduced manufacturing cost. The samé principle 
should apply to reliability. During the service 
life of equipment, the bill for spares, mainte- 
nance, retrofitted changes, and lost operating 
efficiency runs several times the original price. 
Unfortunately, the military services keep the 
money for this kind of expense in one pocket and 
the money for new equipment in another. Because 
of the drive to reduce current procurement costs, 
manufacturers have a hard time getting support for 
reliability improvement programs. We must recog- 
nize the opportunity that exists for substantial 
Savings in the over-all cost of military 
equipment. 


It seems to be characteristic of the elec- 
tronics industry that things are seldom dull. New 
devices constantly upset the established concepts 


of design, and whole new field open up for indus- to handle the fast moving cycle of research, 


_ trial and military applications. Reliability, or development, and manufacture without losing control 
] the lack of it, is just another measure of manage- over the factors that determine the inherent worth 
ment's ability to take these changes in stride -- of the product. 
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UTILIZATION OF COMPONENT PART RELIABILITY 
INFORMATION IN CIRCUIT DESIGN 


M. A. Xavier, L. L. Schneider, P. Gottfried 
Inland Testing Laboratories 
Division of Cook Electric Company 
Morton Grove, Illinois 


Summary, 


Component part reliability testing pro- 
grams of varying scope are in progress in many 
areas of the electronics industry today. These 
programs differ in magnitude, levels of environ- 
mental and electrical stress, and types of com- 
ponent parts tested, but properly designed pro- 
grams have one aspect in common: They can 
result not only in reliability evaluation, but also 
in reliability improvement. This paper will dis- 
cuss techniques for optimizing circuit reliability 
by application of component characteristic data 
obtained from reliability testing. 


This reliability testing, if its value is to 
be maximized, should be conducted concurrent- 
ly with the issuing of circuit design requirements 
and just after comparative evaluation testing has 
selected the most suitable component for an 
application. ; 


Reliability testing of component parts 
yields data regarding the changes in electrical 
parameters, including changes of a catastrophic 
hature, as functions of environmental and load 
stresses and time. Reliability improvement 
results from minimizing these changes or their 
degrading effects‘on the output of the circuit in 
which the component parts are employed. This 
may be accomplished (1)-by selection of the 
most suitable component parts, (2) reduction of 
stresses to the lowest practicable level, (3) cir- 
cuit design to accept known electrical parameter 
drift rates for the required period of operating | 
time of the equipment and (4) circuit design for 
compensation (Trade-off) of drifts of one com- 
ponent type for another. 


Of these techniques, the first two are not 

usually wholly within the province of the circuit 
designer. Parts selection is subject to consi- — 
derations of price, availability, size, and weight; 
it is normally the function of the components 
engineer, working not only with the circuit de- | 
signer but with the. project engineer and the pur- 
chasing department as well. Similarly, stress 
‘reduction is limited by. the above considerations. 
compounded with the factors of package design, 
availability and advisability of cooling, pos ce 
bility of mechanical isolation, and the like. 


jected to service conditions. 


Once parts have been selected and stress 
levels defined, however, it is the circuit de- 
signer's responsibility to effect optimum com- 
ponent parts utilization for reliable performance 
of the circuit. The designer must abandon the 
traditional approach involving "as-purchased" 
values and tolerances, and make maximum use 
of the output of reliability testing: Statistical 
information regarding the changes in electrical 
parameters during service life. 


That the needed component performance 
information must come from reliability testing 
is obvious from a gurvey of available literature. 
Manufacturers' data sheets and catalogs yield 
no more than "typical" values of drift and sur- 
vival under a few-environmental or electrical 
stress conditions, and there is no way of extra- 
polating such limited data to the stress levels 
actually encountered, nor can drift distribution 
or range be determined. Similar limitations are 
inherent in conventional qualification test results, 
which are reduced further in usefulness by not 
being representative of the components actually 
purchased but rather of a carefully selected 
group. : 


As will be seen shortly, the circuit de- 
signer must be able to obtain, directly or by 
interpolation, component parameter drift 
characteristics under the stress conditions 
applicable to the specific equipment, and must 
know the distribution -- unit-to-unit variation -- 
of drift characteristics. Reliability test infor- 
mation of this type is becoming available grad- 
ually as the testing concept is implemented by 
various military agencies and contractors. 


Let's look at Some examples of the applica- 
tion of component performance data. Our first 
step will be to determine the probability of units 
to be used in production drifting outside specified 
circuit tolerance limits, when the units are sub- 
For ease of pre- 
sentation and computation, let us assume that 
value and drift distributions are available in 
histogram form. Figure 1 shows the distribu- 
tion of as-received values, and Figure 2, the 
characteristic distri bution of parameter drift 
of the component type for the stress conditions 
and desired operating time as determined from 
previous reliability testing. ; = 


Percent 
of ‘ 
Population 


-3.5 -1.5 0 1 3.5 


Percent Deviation from Nominal 


Fig. 1 - Distribution of as-received component values. 


. Percent 
of 
Test 

Sample 


Percent of Drift 


Fig. 2 - Drift characteristics for the required period 


of operation. 
We now proceed to a step-by-step compu- . will drift outside circuit tolerance limits, say 
tation to determine the percentage of units which +6% of nominal. 
Initial value re- % of population Drift % of population % of population 
ferred to nominal in this range causing failure exceeding (3) failing ((2) x (4)) 
(1) (2) = e(3) (4) (5) 
Lower Limit 
4.5-5.5 4.0 EVEL) 0.0 0. 00 
3.5-4.5 5.0 -10.0 0.0 0.00 . 
225-335 7.0 - 3.0 0.0 0.00 . 
P= 275 8.0 - 8.0 0.0 0. 00 | 
0.5-1.5 13.0" - 7.0 0.0 _0. 00 
-0. 5-0. 5 15.0 - 6.0 0.0 0.00 - 
-0.5-1.5 20.0 - 5.0 . 0:0 .0. 00 
-1.5-2.5 10.0 - 4.0 0.0 0.00 
-2.5-3.5 3.0 - 3.0 0.0 0. 00 
-3.5-4.5 9.0 - 2.0 3. 0 OF 2 cae 
-4.5-5.5 6.0 - 1.0 10.0 0. 60 
Lower Total © 0.87 (cont. )’ 
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Initial value re- % of population Drift % of population % of population 


ferred to nominal in this range 


causing failure exceeding (3) ‘failing ((2) x (4)) 


(1) my (2) eS ee ee eee (5) 
Upper Limit 

4.5-5.5 4.0 1.0 78.0 SS eelic 
3. 4-4. 5 5.0 2.0 63.0 3.15 
2.5-3.5 uO 3.0 28.0 1. 96 
1.5-2.5 8.0 4.0 8.0 0. 64 
0.5-1.5 13.0 5.0 0.0 0. 00 
-0.5-0.5 15.0 6.0 0.0 0. 00 
-0.5-1.5 20.0 7.0 0.0 0. 00 
-1,5-2.5 10.0 8.0 0.0 0. 00 
-2.5-3.5 3.0 9.0 . 0.0 0.00 
-3.5-4.5 9.0 10.0 0.0 0. 00 
-4,5-5.5 6.0 11.0 0.0 0. 00 
Upper Total 8. 87 
Grand Total 9.74 


Our computations tell us that our com- 
ponent failure rate due to drift will be 9.74, in 
addition to catastrophic failures. (Note that 
allowable drift is ‘computed from the midpoint of 
the value interval,: and that the entire drift con- 
taining the maximum allowable drift is counted 
toward failure contribution; these approxima- 
tions neutralize each other within our limits of 
accuracy. Note also that, for more precise 
computation, drift percentages outside the range. 
in the histogram could be estimated by drawing 
a frequency distribution curve to fit the histo- 
gram. ) 


A component (drift) failure rate of 9.74% 
is likely to be intolerable in most applications. 
We can improve our situation in any or all of 
the following ways: 


1. By increasing circuit tolerances 
By reducing drift (as by stress reduc- 
tion) 

3. By tightening purchase tolerances or 
by tolerance reduction through selec- 
tion from purchased components. 


We assume, for the moment, that steps 
1 and 2 are not possible under our application 
conditions. To determine the procedure to be 
followed in step 3, let's re-examine our table 
of computations. We find that all our failures 
are contributed by components whose as-receiv- 
ed value fails more than 3. 5% below nominal or 
1.5% above nominal; drift failures could be vir- 
tually eliminated by prescribing tolerances of 
plus 1%, minus 3%. In the process of tolerance 
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reduction, 39% of the original components would 
be screened out. To increase yield on future 
orders, it may be appropriate (depending on com- 
ponent type and purchase quantity) to revise the 
nominal value to obtain symmetrical tolerances. 
THE RELIABILITY IMPROVEMENT TECHNIQUE 
DEMONSTRATED IN THIS EXAMPLE IS APPLI- 
CABLE GENERALLY, WITH THE LIMITATION 
THAT DRIFT MUST BE-RELATIVELY INDEP- 
ENDENT OF INITIAL VALUE. 


In many cases, an additional reliability 
improvement may be realized by trade-off 
among component types. In the above example, 
initial tolerances may be decreased by 1% in the 
minus direction (to plus 1%, minus 2%) at the 
relatively insignificant cost of approximately 3% 
of yield. The circuit tolerance may then be 
tightened to plus 6%, minus 5% (of nominal). 
This tolerance reduction may be applied to in- 
crease the tolerance band on another component, 
with a consequent reduction in that component's 
drift failure rate. 


Oftentimes, knowledge of drift character- 
istics (direction, magnitude, and distribution) 
may be utilized in the selection of components 
whose drift is such as to allow trade-off by com- 
pensation. Just as components of appropriate 
temperature coefficients are used in compensa- 
tion for one another under the influence of tem- 
perature variations, drift -- which might appro- 
priately be called a "time coefficient"! -- can be 
employed in compensation for the aging effects 
of operating time. Again, let us illustrate by 
a simple example. 


Fig. 3. -RESISTOR VALUES Fig. 3a.-CAPACITOR VALUES 
45 


Percent 
Ol 
Population 


eH | 
Percent Deviation from Nominal 


Figs. 3 and 3a - Initial distributions of resistor and capacitor 
values. 


Fig. 4. -RESISTANCE DRIFT Fig 4a. -CAPACITANCE DRIFT 
70 


Percent 
of 
Population 


Percent Drift 


Figs. and ha - Drift characteristic distributions for resistor 
and capacitor values. 


We assume that the circuit of interest is a with any of several component types). 
simple R-C network whose time constant (RC plicity, we use broad intervals in the value and 


product) is the governing circuit parameter. We 
‘select component types such that resistor tem- 
perature coefficient and drift are positive, capa- 
citor temperature coefficient and drift negative 
(a condition which may be realized in practice 


4a. 


% Nominal % of Resistor % Nominal % of Capacitor % Nominal 
Resistance Population Capacitance Population RC Product 


96 15 98 10 94.08 
100 45 96. 00 
102 40 _ 97. 92 
104 5 99. 84 
98 35 98° 10 96.04 
100 45 98. 00 
102 40 99. 96 
104 5 101. 92 
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% of RC 
Eopleers 


1750) 
6. 75 
6. 00 
5 75; 


3.50, 
TSS 5 
14. 00 

es 


For sim- 


drift histograms shown in Figures 3, 3a, 4, and 


From the initial component value distribu-_ 
tion of time constants is computed as follows: 


(cont. ) 


% Nominal % of Resistor % Nominal % of Capacitor % Nominal % of RC 


Resistance Population Capacitance Population RC Product Population 

100 30 98 10 98. 00 3.00 
100 45 100. 00 13. 50 

102 40 102. 00 12. 00 

104 B 104. 00 1. 50 

102 20 98 10 99. 96 2.00 
100 45 102. 00 9.00 

102 40 104. 04 8. 00 

104 5 106. 08 1. 00 

100. 00 


Rounding and summarizing the initial distribution of time constants becoming, 


% Nominal % of RC 
RC Product Population 
94 2 the EW) 
96 10. 25 
98 24.75 
100 30. 25 
102 22.75 
104 9. 50 
106 1. 00 
100. 00 


We now proceed to compute the resistance and capacitance distributions at the end of the 
desired service life (due to drift): 


% Nominal % Nominal 
Resistance % of % of % of Resistance % of 
( Initial) Population Drift Population (final) Population 
96 15 0 20 96 3.00 
Zz 70 98 10. 50 
4 10 100 1.50 
98 35 0 20 98 7.00 
2 70 100 24. 50 
4 10 102 S750 
100 30 0 20 100 6.00 
( 70 102 21.00 
4 10 104 3.00 
102 20 0 20 102 4. 00 
2 70 104 14. 00 
4 10 106 2.00 
100. 00 
Summarizing: 
% Nominal % of 
Resistance Population 
96 3. 00 
98 17. 50 
100 32.00 (cont. ) 


6h, 


; % Nominal 
Summarizing: 


1L02a0 


104 
106 


And, for capacitance: 


% Nominal 


Capacitance % of 
(Initial) Population 
98 10 
100 45 
102 40 
104 5 


% Nominal 


Summarizing: Capacitance 


’ Resistance 


% of 
Population 


15 
60 
25 


15 
60 
25 


15 
60 
25 


% of 
Population 
28. 50 
17. 00 
2.00 
100. 00 
% Nominal 
Capacitance % of 
(final) Population 
92 1. 50 
94 6. 00 
96 2. 50 
94 6.75 
96 27.00 
98 WON 74} 
96 6. 00 
98 24. 00 
100 10. 00 
98 0.75 
100 3.00 
102 ils 745) 
100. 00 
% of 
Population 
1. 50 
12575 
35. 50 
36. 00 
13.00 
1. 25 
100. 00 


From the distributions of final values of resistance and:capacitance, we compute the final dis- 
tribution of time constants, this time rounding as we proceed: 


% Nominal % of Resistor 


Resistance Population 
96 3.00 


98 17. 50 


% Nominal 


Capacitance 


% of Capacitance 
Population 
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150 
12.75 


% Nominal % of RC 


RC Product Population 


88 0.045 
90 0. 382 
92 1. 065 
94 1. 080 
96 0. 390 
98 0. 038 
90 0. 262 
92 2. 231 
94 6. 213. 
96 6. 300 
98 2. 275 

100 0.219 


(cont. ) 


% Nominal % of Resistor % Nominal % of Capacitance % Nominal h of RC 


Resistance Population Capacitance Population RC Product Population 
100 32. 00 92 1.50 92 0. 480 
94 12.75 94 4.080 
96 35.50 96 11. 360 
98 36. 00 98 11. 520 
100 13.00 100 4.160 
102 1. 25 102 0. 400 
102 28. 50 92 1.50 94 0. 427 
94 12.75 96 3. 634 
96 35. 50 98 10.118 
98 36. 00 100 10. 260 
100 13. 00 102 B05 
102 125 104 0. 356 
104 17. 00 92 1.50 96 0. 255 
94 W2.t5 98 2.168 
96 35.50 100 6. 035 
98 36. 00 102 6. 120 
100 13. 00 104 zZ. 210 
102 1Z5 106 0. 212 
106 2. 00 92 1. 50 98 *0. 030 
94 L2Zee5 100 0.255 
96 35.50 102 0.710 
98 36. 00 104 0.720 
100 13. 00 106 0. 260 
102 1.25 108 0.025 
100. 000 
Summarizing and comparing with the initial distribution: 
% Nominal % of Popula- % of Popula- 
RC Product tion (Initial)* tion (Final) Change 
88 0. 000 0. 045 0.045 
90 0.000 0. 644 0. 644 
92 0. 000 3.776 3.776 
94 1. 500 11. 800 10. 300 
96 10. 250 21. 939 11. 689 
98 24. 750 26. 149 1. 399 
100 30. 250 20. 929 -9. 321 
102 22.750 10. 935 -11. 815 
104 9.500 3. 286 -6. 214 
106 1.000 0.472 -0.528 
108 0. 000 0.025 0.025 


* Significance of figures is apparent, not actual -- at best, significance extends only to first 
decimal place. 


Despite the obvious and unavoidable broad- tial tolerances, appropriate shifting of nominal 
ening of the time constant range due to drift, it value for procurement purposes, and trade-off 
will be noted that only about 4.5% of the circuits of tolerances between the component types for 
have drifted out of the original range. By way the most economical attainment of reliability 
of comparison, 19% of the resistors and nearly objectives. 

50% of the capacitors have drifted out of their 

original ranges when they are considered indep- Life test measurement data contain, when 
endently. As discussed previously, even further individual component part identity is maintained 
improvement could be gained by reduction of ini- throughout the test, two types of information. 


The first type is frequency distribution for 
various points in time which show the distribu- 
tion of absolute values. The second type of in- 
formation is frequency distributions of para- 
meter changes for points in time. In application 


Percent 


of 


Population 


94 


such as communications circuitry for example, 
where circuits are ''trimmed" as part of the 
production process, the parameter changes as 
a function of time are of most immediate inter- 
est; in other applications, distribution of ab- 


98 102 106 


Percent of Nominal RC Product 


Fig. 5 - Initial distribution of time constants. 
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100 104 
‘Percent of Nominal Resistance 


35.5 36.0 


92 96 100 
Percent of Nominal Capacitance 


Fig. 6 - End of service life distributions of values. 
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96 100 
Percent of Nominal RC Product 


Fig. 6a - End of service life distribution of time constants. 
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Percent 
of 
Population 


Initial Values 


Percent 
_ of 
’ Population 


101 103 


3 


as Percent of Nominal 


5 


Percent Drift 


10% of Population within 101 to 103% x 3% of Population drifting 
3 to 5% = 0.3% of Population ending within approximately 105 to 107% 


Percent 
of 
Population 


105 107 


Final Values as Percent of Nominal 


Fig. 7 = Sample computation. 


solute values may be the more useful type of 
presentation. It should be emphasized that a 
data presentation that contains only absolute 
values as a function of time can be misleading 
because large changes of individual units may 

be masked. Our examples required both types 
of information. Generally, in the interests of 
economy of presentation, only a distribution of 
initial values and distributions of parameter 
changes as a function of time are essential 

since absolute value distributions may be readily 
derived from the change information. Any of. 
the computations covered in this paper may be 
Simplified where manageable frequency functions 
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can be substituted for histograms; such functions 
are rarely found in practice. 


As demonstrated in this paper, the tech- 
nique of computation of expected distribution of 
parameter values at any point in time is straight- 
forward. The designer using reliability test ‘ 
results must be aware of the necessity of deter- - 
mining initial value distributions from incoming 
inspection records, and of his power to change 
these distributions in favorable directions by 


‘basing purchasing specification requirements 


on circuit reliability analysis. 


be ADDENDUM TO THE PAPER 
AN APPLICATION OF THE BOX TECHNIQUE 
TO THE EVALUATION OF ELECTRICAL COMPONENTS" 


Robert Glaser 
Light Military Electronic Equipment Department 
General Electric Company 
Utica, New York 


Presented here are examples of the statis- 
tical analysis of the responses for two of the 
variables, Pulse Response Factor, and Recs re- 
ferred to in the titled paper. It is intended to 
show a step-by-step procedure in analyzing the 
results with particular emphasis placed on the 
aheres in preparing the Analysis of Variance 

able. 


As a preliminary step, the response for 
each variable was re-examined and that data 
which was felt to be inconsistent with the balance 
of the data was removed. The response equa- 
tions were then recalculated, this time using the 
design levels (0, +1, +a) rather than the actual 


values of the independent variables. The new 
equations thus calculated were: 
Pulse 
A 
Y=-18.9 -4.6% + .3X + .8X% 
1 2 3 
e216% - Aah ho #320 X" 
1 2 3 
eG ke de am ee Se 1,1 XX 
Lee 3 7) fs 
Recs 


9 =17.9+44.3X% + .4X% +.7X% 
1 2 3 


2 fed 2 2 
+4.4X = Ook - 1.5 X, 
1 2 
xX aX 
2 3 


=p + 76 ROX - 
1. *2 i 3 
Using the design levels in these equations 
corresponding to the actual levels of our check 
point: T = 90°C (.67), V = 33 volts (.60) and 
P = 75 mw (. 23), we get the predicted percent 
changes: 


Pulse 
Recs 

= 49.2 

These differ slightly from those previously 


computed. The variance of this estimate can be 
obtained from the expression: 


y eer top ee Loe 
Ee GOs [attr (ere ia 


a 
egies Jape GOr 


; ere 2 [am peor / 
where n = the number of factors 
n iy 
N=(2 + 2n +k) points 


C& = the distance of the "prong" points from 
the centroid 


2 
The value foro taken here is the estimate of 
error at the center points. It is pointed out by 
Dr. Box that: "In cases where the variance is not 


_ constant at different points, the ordinary method 
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of least squares applied to the mean values of the 
points will not provide estimates having the 
smallest possible variance. However, the esti- 
mates will be unbiased, and provided variances do 
not differ too much, will be fairly efficient." 


The variances about the predicted values at 
the check point are: 


1.99 
91 


Pulse Response = 
Res Response = 


From this we determine that the actual 
value (-16.3%) for the Pulse Response lies with- 
in three sigma of the predicted value. However, 
the actual value of Res (28.2%) lies extremely far 
from the predicted value. A look at the analysis 
of variance tables for the two responses indicates 
why. 


ANALYSIS OF VARIANCE 


To obtain the analysis of variance table the 
following calculations must be made: 


Pulse Response 
A. Total sum of squares corrected for the mean 
with (N-1) degrees of freedom (19 in this 
example) = 


Zy- era a 


B. Sum of squares due.to regression with(N - 1 d.f. 


for each coefficient estimated) degrees of free- 
dom (10) = Zy2 -A'x'y = 144.5 (B’ = row 

vector of betas, X' = row vector of the indepen- 
dent variables, and Y = the column vector for the 
dependent variable. ) 


C. Error sum of squares taken from one or more 
of the experimental points (k center points in this 
case) with (k-1) d.f. (5) = 


Zig, - KEE)" resie] 


D. Lack-of-fit sum of squares by subtraction 


(B-C) with (B d.f. -C d.f.) =  5d.f., this 
equals 113.4. - 


E. Linear sum of squares taken from the re- 
gression equation with one d.f. for each of the 
linear terms (3) = 3 (bjx;)? = bj? Ex 2 + 


bo” Exo” +b37 Xx” = 274.5 


F. Quadratic sum of squares with (A-B-E) d.f. 
(6) = 230. 4. 


Putting this information in the analysis of variance 


table we get: 


d.f. S.5. M.S. 
Linear 3 274.5 91.5 
Quadratic 6 230.4 38.4 
yuack-of-fit 5 113.4 22.7/14.4 
Residual with 10 
\Error 5 sist 6.2\d.f. 
Total 19 649. 4 


TEMPERATURE °C 


From this table we see that at the 95% con- 
fidence level "lack-of-fit'"' is not significant. 
Pooling the error and lack-of-fit sums of squares 
and their degrees of freedom we calculate the 
residual error mean square. Using this in the 
F-test we find the quadratic terms are not signi- 
ficant, the implication being that a linear model 
might well have described the response. 


If similar calculations are done on the Rcs 
response, the resulting table is: . 


d.f. S.S. M.S. 
Linear 3 24,833.3 8,277.8 
Quadratic 6 259.4 me 4aSeo 
yvack-of-fit 5 ail Ore 43.1 
Residual 
\Error 5 14, 2 2.8 
Total 19 2522.0 


Here we see that a definite lack-of-fit con- 
dition exists, and a closer inspection of the data 
is essential. One technique for doing this is to 
diagram the original experimentel points show- 
ing the actual response and the residual at:each 
point. These are seen in figures 1 through 4. 
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‘Fig. 1 -- Pulse Responses. 
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Fig. 3 -- Rg, responses. 
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Fig.  -- Res residuals. 


In each case, the residuals appear to be 
somewhat less than random in that the centroid 
and the prong points are all of the same sign and 
the corners of the cube are of the opposite sign 
(with one exception). This could indicate some 
kind of blocking effect for one or more of the 
variables. 


Looking at the actual values, Pulse 
Responses are-all negative and follow somewhat 
of a parabolic surface (as indicated in the origi- 
nal paper). However, the Rcs responses range 
from a low -32.6% to a high 97.0% along the 
temperature axis. This somewhat "exponential" 
change is reflected in the "lack-of-fit'' mentioned 
above. This does not imply that the situation is 
entirely hopeless nor that the experiment was a 
complete failure, for to quote Dr. Box again;".. 
in the particular example considered, where we 
are investigating a whole region, (some of the 


variables do in fact extend over wide ranges, e.g., 
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power 50 to 400 mw and temperature -41° C to 
141°C) ... the function is expected to be smooth 
and might therefore be approximated by a simple 
equation of the quadratic type... it is important 
to check this and to be prepared to find either 
that a simple expression cannot be applied or; 
alternatively, possibly that it can only be applied 
after some transformation has been applied to 

the experimental variables. For example, it may 
be better to use the logarithm of the power rather 
than the power itself."" Such transformations are 
being investigated now. 


As a final comment on the use of the analysis 


of variance table it should be pointed out that it--. 
is important in indicating what proportion of the 
variance may be attributed to the linear terms, 
and what proportion of the variance is due to the 
quadratics. Where the quadratics give no marked — 
contribution it may have been better to have used 
only the linear model. 


——— 


—w 


